I'm new to CakePHP and am wondering how to protect my forms from Cross Site Request Forgery, ie adding a nonce to the forms. I've set the salt in the config file.
+1
A:
You have to add the Security component to the $components array of your controller(s):
public $components = array('Security');
CakePHP will then automatically add a nonce to your form when you use the Form helper to create your forms.
dhofstet
2009-10-18 09:34:38
A:
you can also import the Sanitze lib for extra strong security
http://book.cakephp.org/view/153/Data-Sanitization
App::import('Sanitize');
$badString = ";:<script><html>< // >@@#";
echo Sanitize::paranoid($badString);
// output: scripthtml
echo Sanitize::paranoid($badString, array(' ', '@'));
// output: scripthtml @@
dogmatic69
2009-10-19 12:40:58