Drupal Database Queries

CRITICAL: Never Concatenate SQL

// WRONG — SQL injection risk
$result = $this->database->query("SELECT * FROM {node} WHERE type = '$type'");

// CORRECT — parameterized query
$result = $this->database->query(
  "SELECT nid, title FROM {node} WHERE type = :type",
  [':type' => $type]
);

Select Query