Sql injection and updateall cakephp issue

Question

I'm running into a problem in cakephp when I use this query

$this->Rh->CompetencesUser->updateAll(array(
    'CompetencesUser.niveau' => "'$value[1]'",
    'CompetencesUser.expertise' => $value[2],
    'CompetencesUser.rh_id' => $this->Rh->getLastInsertId()
), array(
    'CompetencesUser.user_id' => $this->request->params['pass'][0],
    'CompetencesUser.competence_id' => $value[3]
));

it works but when I give some characters like ' in the field $value[1] it shows an error, so how I can escape this character or can I use another method, because the $value[1] don't work without adding those quotes.

Answer 1

As stated in the docs "Literal values should be quoted manually using DboSource::value()."

For example:-

$db = $this->Rh->CompetencesUser->getDataSource();
$this->Rh->CompetencesUser->updateAll(
    ['CompetencesUser.niveau' => $db->value($value[1], 'string')],
    [ // Some conditions ]
);

In most cases updateAll() is not the right choice of method for saving data and save() would be better suited. Take a look at Use CakePHP 2's updateAll() Method with Caution!