Empty response when making a Select with 2 where clauses - sql

Question

My function of XMLRPC works like this, check if content already exists at my website, if it is up-to-date and update it if necessary.
To do it I check for it´s number ( both content types can have same number) it´s hash (unique) and type.
Before I had only one kind of content, and my function was working properly , but now I need to check also content type instead of only number and hash.
that is the problem, whem I try to do it, I got an empty anwser. My Function now is like this:
$query = db_query("SELECT (table_num.field_num) FROM (table_num, table_type) WHERE table_num.entity = table_type.entity AND table_num.field_num = :num AND table_type.field_type = :type", array(':num' => $num, ':type' =>$type));
foreach ($query as $record) {
if($record->rowCount()==0) return 0;
else {
$query = db_query("SELECT (table_hash.field_hash) FROM (table_hash, table_type) WHERE table_hash.entity = table_type.entity AND table_hash.field_hash = :hash AND table_type.field_type = :type", array(':hash' => $hash, ':type' =>$type));
foreach ($query as $record) {
if($record->rowCount()==1) return 1;
else{
$query = db_query("SELECT (table_num.entity_id) FROM (table_num, table_type) WHERE table_num.entity = table_type.entity AND table_num.field_num = :num AND table_type.field_type = :type", array(':num' => $num, ':type' =>$type));
foreach ($query as $record) {
echo $record->field_entity_id;
}
return $record;
P.S. when it returns 0 it does not exists in my DB, 1 is when it´s up to date and entity when I need to update it.
Sorry for long SQL but I just start to use it, and I didn´t manage to get it shorter.
Does someone have any idea why I am getting an empty anwser?

Answer 1

The way your building your queries is dangerous and lead to SQL injection as your not escaping your variables.
Instead of:
$query = db_query("SELECT (table_num.field_num) FROM table_num WHERE table_num.field_num = $num AND table_type.field_type = $type");
You can use:
$query = db_query("SELECT (table_num.field_num) FROM table_num WHERE table_num.field_num = :num AND table_type.field_type = :type", array(':num' => $num, ':type' =>$type));
This way Drupal will sanitize your variables before inserting them so you know it won't lead to any vulnerabilities.
I don't actually fully understand what your question is asking - if you could clarify it a bit I'll see if I can help with that too...