SQL query rather than CakePHP style query

Question

I have a really complex query: so much table (and... so much nested model). I feel more comfortable, using raw SQL query rather than CakePHP query syntax. As far as I know, I should prefear CakePHP syntax, cause it is almost immune to attack.

Considering that I won't use Cake's syntax, there's a way to join the security of cake approach with the practicalness of raw SQL approach?

You can try use PDO with Prepare statements without bothering what user enters letter, number or illegal character. Still I would prefer stick with cake as much it possible due models management reasons. — user9440008
– user9440008, Commented Sep 1, 2012 at 5:55

Arash Mousavi · Accepted Answer · 2012-08-31 12:43:44Z

1

I think if you use pdo adapter for mysql, its provide security for sql injection.

I addition you can use Sanitize::clean and Sanitize::escape to escape your query.

answered Aug 31, 2012 at 12:43

Arash Mousavi

2,1465 gold badges28 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

BAD_SEED Over a year ago

I had even thinked to validate input arguments and if needed raise error to avoid real query. For example: if the where needs a int, then, if i get a string raise error.

Arash Mousavi Over a year ago

if you do it, you can be sure that you protect your query from sql injection.

Collectives™ on Stack Overflow

SQL query rather than CakePHP style query

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related