A whirlwind tour of Drupal best practices, presented at the Chicago CMS Expo in April 2008. See http://cmsexpo.net for more information.

1. Drupal Code: Day 2
the good, the bad, and the nerdy

2. we join our cms,
already in progress

3. drupal core
coordinates
http://www.flickr.com/photos/35104960@N00/509525572/

4. drupal
announces
events

5. hooks let
modules
listen

6. modules
react

7. ...and change
behavior
http://www.flickr.com/photos/spiicytuna/188111824

8. happy baby
is happy

9. FormAPI

10. $form[‘foo’] = array(
‘#type’ => ‘textarea’,
‘#required’ => TRUE,
‘#title’ => t(‘Your foo’),
‘#default_value’ => “Some text…”,
‘#resizable’ => TRUE,
);

11. $form[‘bar’] = array(
‘#type’ => ‘fieldset’,
‘#title’ => t(‘Several bars’),
‘#collapsible’ => TRUE,
‘#collapsed’ => FALSE,
);

13. $form[‘bar’][‘baz’] = array(
‘#type’ => ‘select’,
‘#title’ => t(‘Baz in a bar’),
‘#options’ => array(
1 => t(‘Option one’),
2 => t(‘Option two’),
3 => t(‘Option three’),
),
‘#multiple’ => TRUE,
‘#default_value’ => 2,
‘#weight’ => -10
);

15. function mymodule_settings_page() {
return drupal_get_form(‘mymodule_form’);
}
function mymodule_form() {
$form[‘foo’] = array(
‘#type’ => ‘textarea’,
‘#title’ => t(‘Your foo’),
‘#default_value’ => t(‘Enter your text here…’),
);
$form[‘submit’] = array(
‘#type’ => ‘submit’,
‘#value’ => t(‘Pity the foo’),
);
return $form;
}

16. function mymodule_settings_page() {
return drupal_get_form(‘mymodule_form’);
}
function mymodule_form() {
$form[‘foo’] = array(
‘#type’ => ‘textarea’,
‘#title’ => t(‘Your foo’),
‘#default_value’ => t(‘Enter your text here…’),
);
$form[‘submit’] = array(
‘#type’ => ‘submit’,
‘#value’ => t(‘Pity the foo’),
);
return $form;
}

17. function mymodule_form_alter($form, &$state, $id) {
if ($id == ‘yourmodule_form’) {
unset($form[‘your_field’]);
$form[‘my_extra_field’] = array(
‘#type’ => ‘textarea’,
‘#title’ => t(‘THIS field is mine.’,
‘#weight’ => -10,
);
$form[‘#validate’][] = ‘my_validation_code’;
$form[‘#submit’][] = ‘my_submit_code’;
}
}

18. function mymodule_form_validate($form, &$state) {
if ($state[‘values’][‘foo’] == ‘Yo Momma’) {
form_set_error(‘foo’, t(‘Show some respect.’));
}
}
function mymodule_form_submit($form, &$state) {
variable_set(‘my_foo’, $state[‘values’][‘foo’]);
}

19. Key Pieces
• Form ID
• Form Builder function
• Validation functions
• Submission functions
• “Form State”

20. happy baby
is happy

21. best practices

22. best practices

23. theme()

24. function build_my_page() {
$output = ‘<h3>My stuff</h3>'
$records = get_records();
$output .= ‘<ul>’;
foreach ($records as $record) {
$output .= “<li>”. $record->name .”</li>”;
}
$output .= ‘</ul>’;
return $output;
}

25. function build_my_page() {
$output = ‘<h3>My stuff</h3>'
$records = get_records();
$output .= ‘<ul>’;
foreach ($records as $record) {
$output .= “<li>”. $record->name .”</li>”;
}
$output .= ‘</ul>’;
return $output;
}
function build_my_page() {
$records = get_records();
foreach ($records as $record) {
$items[] = $records->name;
}
return theme(‘item_list’,
$items, t(‘My stuff’));
}

26. function mymodule_theme() {
return array(
'mymodule_data' => array(
'arguments' => array(
'data' => NULL,
'option' => TRUE)));
}
function theme_mymodule_data($data, $option) {
$output = ‘<em>’. $data->foo .’</em>’;
if ($option) {
$output .= ‘ <b>’. $data->bar .’</b>’;
}
return $output;
}

27. use theme() for
all html

28. db_query()

29. function get_my_data($username) {
$sql = “SELECT * FROM users “;
$sql .= “WHERE name = ‘$username’”;
$results = mysql_query($sql);
return $results;
}

30. function get_my_data($username) {
$sql = “SELECT * FROM users “;
$sql .= “WHERE name = ‘$username’”;
$results = mysql_query($sql);
return $results;
}
function get_my_data($username) {
$sql = “SELECT * FROM {users} u “;
$sql .= “WHERE u.name = ‘%s’”;
$results = db_query($sql, $username);
return $results;
}

31. use db_query() for
all queries

32. l()

33. $link = “<a href=‘/about-us’>About!</a>”;

34. $link = “<a href=‘/about-us’>About!</a>”;
http://www.mysite.com/node/1
http://www.mysite.com/seo-friendly-name
http://www.mysite.com/subdirectory/node/1
http://www.mysite.com/index.php?q=node/1
http://www.mysite.com/fr/node/1

35. $link = “<a href=‘/about-us’>About!</a>”;
http://www.mysite.com/node/1
http://www.mysite.com/seo-friendly-name
http://www.mysite.com/subdirectory/node/1
http://www.mysite.com/index.php?q=node/1
http://www.mysite.com/fr/node/1
$link = l($title, $url);

36. use l() for all links

37. t()

38. function my_message($name) {
return “This is your message, $name!”;
}

39. function my_message($name) {
return “This is your message, $name!”;
}
function my_message($name) {
$values = array(‘%name’ => $name);
$message = ‘This is your message, %name!’;
return t($message, $values);
}

40. use t() for all
UI text

41. PHPDoc

42. /**
* Prepares a structured form array by adding required elements,
* executing any hook_form_alter functions, and optionally
* inserting a validation token to prevent tampering.
*
* @param $form_id
* A unique string identifying the form for validation,
* submission, theming, and hook_form_alter functions.
* @param $form
* An associative array containing the structure of the form.
* @param $form_state
* A keyed array containing the current state of the form.
* Passed in here so that hook_form_alter() calls can use it,
* as well.
*/
function drupal_prepare_form($form_id, &$form, &$form_state) {
// Actual codes goes here…
}

43. drupal core
1%
Code
37%
Comments
Jokes
62%

44. use PHPDoc to
explain your code

45. Coder module

46. hook, don’t hack

47. happy baby
is happy

48. security
(never trust anyone)

49. SQL Injection

52. function get_my_data($name, $date) {
$sql = “SELECT * FROM {users} u “;
$sql .= “WHERE u.name = ‘%s’ ”;
$sql .= “AND u.created > %d ”;
$results = db_query($sql, $name, $date);
return $results;
}

53. function get_my_data($name, $date) {
$sql = “SELECT * FROM {users} u “;
$sql .= “WHERE u.name = ‘%s’ ”;
$sql .= “AND u.created > %d ”;
$results = db_query($sql, $name, $date);
return $results;
}
%s, %d, %f, and %b are your friends

54. XSS
(use output filtering)

55. XSS
(use output filtering)

56. XSS
(use output filtering)
Use filter_xss($text)

57. CSRF

58. CSRF
Use FormAPI. ALWAYS.

59. input formats
(PHP, oh noes)

60. input formats
(PHP, oh noes)

61. http://drupal.org/
writing-secure-code

62. happy baby
is happy

63. Performance
(It’s always the db)

64. cold hard cache

65. cold hard cache

67. devel module

68. devel module

69. devel module

70. make your
own cache

71. function my_module_stuff($reset = FALSE) {
static $stuff;
if (!isset($stuff) || $reset) {
if (!$reset && ($cache = cache_get('my_stuff'))) {
$stuff = $cache->data;
make your
}
else {
own cache
// Do your expensive calculations here,
// and populate $my_data with stuff..
cache_set('my_stuff', $stuff);
}
}
return $stuff;
}

72. happy baby
is happy

73. the community

74. sign up. seriously.

75. participate

76. participate

78. • Always use FormAPI
• Follow best practices (Coder helps!)
• It’s always the DB’s fault (cache)
• Don’t trust anyone (sanitize output)
• Participate!

79. happy baby
is happy