Drupal 7 Module Development

Database Access
Basic queries
Most SELECT queries are, in practice, fairly simple and do not change. Drupal calls
these static queries, and they are very straightforward to use.
For example, to get a list of all enabled modules in the system, we could run the
following query:
$result = db_query("SELECT name, filename FROM {system} WHERE type =
:type AND status = :status", array(':type' => 'module', ':status' =>
1));
In practice, if we wanted to get that information we would simply
call module_list() instead, but for the purposes of this example
we'll do it the manual way.
The query looks very much like normal SQL that we would expect to see anywhere
else, but there are a few important items to mention.
• All SQL table names are wrapped in curly braces. That identifies the string
as a table name to the database layer and allows Drupal to easily add a
configured prefix to all tables for a given Drupal instance.
• There is no MySQL-specific syntax (or any database-specific syntax)
anywhere in the query.
• There are no literal values in the query. Instead, literal values are specified by
placeholders. Values for placeholders are specified in an associative array as
the second parameter to db_query().
Those placeholders are significant. They allow us to separate the query from the
values in the query and pass them to the database server separately. The database
server can then assemble the query string and placeholder values as needed, with
full knowledge of what data type makes sense in each case. That eliminates most
(although not quite all) opportunities for SQL injection from unexpected data.
There are three other important things to remember about placeholders:
• Placeholders must be unique within a query, and must begin with a colon.
• Placeholders should never have quotation marks around them, regardless of
the data type. The database server will handle that for us.
• Placeholders should be used for all literal data, even if it will not vary.
This third point is important for cross-database portability, as separating out literal
values allows database drivers to make database-specific optimizations.
[ 364 ]