How do you escape SQL data in CakePHP?

Question

For some reason the AppModel->updateAll() method does not escape data passed to it. Looking over the documentation though, I can't find anything on how you actually escape data with CakePHP.

Down in datasources/dbo/dbo_mysql.php I found the value() method that seems to just use mysql_real_escape_string() - but how do you access that method from up in the models?

Answer 1

$name = "somename";

$db = $this->getDataSource();
$this->Model->query('SELECT * FROM models WHERE name = '.$db->value($name, 'string') . ';');

CakePHP cares also about quoting your input, because it is marked as a string.

SELECT * FROM models WHERE name = "somename";