I need to change the ordering of which the products are displayed on the Virtuemart category page. The files models/product.php
and tables/products.php
are too complicated for me to put the changes in them. So I decided to use direct SQL-requests in views/category/default.php
(if more precisely in templates/my_template/html/com_virtuemart/category/default.php
) like:
$db = JFactory::getDBO();
$query = $db->getQuery(true);
$query->select('a.virtuemart_product_id');
$query->from('#__virtuemart_product_categories AS a');
$query->where($db->quoteName('virtuemart_category_id')." = ".$db->quote($this->category->virtuemart_category_id));
$query->select('b.product_in_stock, c.product_price');
$query->join('LEFT', '#__virtuemart_products AS b ON b.virtuemart_product_id = a.virtuemart_product_id');
$query->join('LEFT', '#__virtuemart_product_prices AS c ON c.virtuemart_product_id = a.virtuemart_product_id');
$query->order('b.product_in_stock DESC, c.product_price DESC');
$db->setQuery($query);
$sortedProducts = $db->loadObjectList();
...
It's not the only case when I needed to use direct SQL-requests in some view(s) or in template(s).
But to what extent is such direct way safe and how to protect it to the maximum extent possible?