CakePHP: Sanitizing data when sending to Model::find

Question

When sending data to Model::find or Model::read, e.g. when I want to load a record like:

$this->MyModel->read(null, $id);

I usually wrap the $id in intval(); to protect from unintended or malicious use.

Is this necessary? Does anyone know what cake does to conditions and fields inside a Model::find() query?

PS: I use cakephp bare, no custom setup done, as far as models go.

Answer 1

No,it's not necessary.Cakephp's mysql layer for DBO has done that for you.

Answer 2

As long as you are not using Model->query(..) the Cake ORM will escape these values prior to writing them to the database.

Checking your data types with intval() or is_numeric() is a good practice for validating user supplied content though.