Just a few thoughts about the query you're using to fetch the nodes:

		$sql = "SELECT n.title, n.nid FROM {node} n WHERE n.type IN ($scrolltext_nodetype) "
		      ."ORDER BY n.created DESC LIMIT $scrolltext_count";	
		$results = db_query($sql);

Firstly I'd advise against placing the variables directly in the string; general practice with db_query is to lift user-configurable variables out using %s substitution, so the function can validate the variables and determine whether there's anything dangerous in there.

Secondly this query doesn't respect the published status of the nodes.

If you wanted to get fancy you could add checks based on the user's privileges (maybe only filter out unpublished nodes if they're not logged in with node administration privs) but as a basic step forwards I'd propose something like this:

		$sql = 'SELECT n.title, n.nid FROM {node} n '
		      .'WHERE n.type IN (%s) '
		      .'AND n.status = 1 '
		      .'ORDER BY n.created DESC LIMIT %d';
		$results = db_query($sql, $scrolltext_nodetype, $scrolltext_count);

... Though you may want to investigate exactly what different values are available to n.status and make sure db_query works that way.

While I'm here I'll mention that the coding standards mention using two-space indents instead of tabs, I've been chewed out for that before :)

Comments

mlncn’s picture

This also could be addressed by choosing a view to filter what to show, though it would make Views a requirement. Probably having both options (with this suggested cleanup) is best?

benjamin, Agaric Design Collective

drupalnesia’s picture

thanks kingandy, now version 5.x-1.2 only display "published" node.

drupalnesia’s picture

Status: Active » Closed (fixed)

Version 5.x-1.2 available now.