Does CakePHP have built-in functions to check for MySQL injections?

Question

Does CakePHP check inputs to see if they are valid and not injections? If not, how would I go about implementing functions to check inputs? Most of Cake's processes are done behind the scenes, so I'm unsure of where I would do that.

Answer 1

You can use the sanitize class in the controller to prevent against sql injections, specifically the escape method.

Check here for more details:

http://book.cakephp.org/view/153/Data-Sanitization

To give a quick example for posted input:

if(!empty($this->data)
{
    App::import('Sanitize');
    $this->data['Model']['dirtyInput'] = Sanitize::escape($this->data['Model']['dirtyInput', 'default');
}

Also, check out the clean method for a way to clean both HTML and sql injections from your whole $this->data array

Answer 2

CakePHP's ORM functionality automatically cleans up any input to prevent SQL injection.