Drupal 7 Module Development

Appendix A
The join() methods all return the alias for the table that was actually used, so we
can use that in later method calls. In this case we will also select one field from the
users table, the user's name, and alias it to "username". Again, since there's a slight
chance the alias could already be used, addField() will return the alias that was
actually used for that field.
Our effective query now looks like this:
SELECT n.nid AS nid, n.title AS title, u.name AS username FROM {node}
n INNER JOIN {users} u ON u.nid = n.nid
Now we need to restrict the query, that is, add the WHERE clauses. That is done with
the condition() method, which takes a field name, the value to match against, and
optionally a comparator. The default is equals. The above lines, therefore, add WHERE
clauses for a username of 'Bob' and a node creation time within the past week (that
is, where the creation timestamp is greater than or equal to the current time minus
seven days' worth of seconds). For more complex conditionals there is also a where()
method that takes an SQL fragment.
We then tell the query to order by creation time, in descending order (DESC) and to
only return five results starting with record 0, that is, the five most recently created
nodes. Our SQL query now looks something like this:
SELECT n.nid AS nid, n.title AS title, u.name AS username
FROM {node} n
INNER JOIN {users} u ON u.nid = n.nid
WHERE (n.created >= 1286213869)
AND (u.name = 'Bob')
ORDER BY n.created DESC
LIMIT 5 OFFSET 0
There's one more important method to call—addTag(). This method doesn't
affect the query directly but does mark the type of query it is. If a query has been
tagged then before it is turned into an SQL string it will be passed through
hook_query_alter() and hook_query_TAG_alter(). That allows other modules
an opportunity to change the query if they need to. The node_access tag, used here,
is most important as it allows the node access system to alter the query, to filter out
nodes that the current user should not have access to.
When querying the node table, always us a dynamic query with the
node_access tag. If you do not, then you have a security hole.
[ 367 ]