How do you escape sql data in CakePHP?

Question

For some reason the AppModel->updateAll() method does not escape data passed to it. Looking over the documentation though, I can't find anything on how you actually escape data with CakePHP.

Down in datasources/dbo/dbo_mysql.php I found the value() method that seems to just use mysql_real_escape_string() - but I have no idea how to access that method from up in my models.

So how do you?

Answer 1

From the Cake website

CakePHP already protects you against SQL Injection if you use CakePHP's ORM methods (such as find() and save()) and proper array notation (ie. array('field' => $value)) instead of raw SQL. For sanitization against XSS its generally better to save raw HTML in database without modification and sanitize at the time of output/display.

http://book.cakephp.org/view/153/Data-Sanitization