Type of string escape done defaultly by cakePHP

Question

Does cakePHP use mysql_real_escape_string for sql data and strip_tags and html encode by default or should it be done by the user/programmer?

Answer 1

Cake's DboMysql adaptor is mysql_real_escaping strings, but may do other things for other types and values (such as using NULL). See for yourself: http://api.cakephp.org/view_source/dbo-mysql/#l-628