Tips & tricks CakePHP # 2

In connection with the release of pre-beta 1.2, the second issue of tips & tricks. We continue to acquaint you with the ideas and problems of version 1.2, the pre-beta features that we met in the process of developing a social network.
In addition, we started a blog on Habré - join, ask questions. I think we have something to discuss.

New core.php!

The most important change in pre-beta is the new core.php file format! Be sure to replace this file when updating and configure it as you wish. In principle, the entire description of the parameters is already there.
By the way, in database.php it worked fine

'encoding' => 'utf8'

And you do not have any tricks with AppModel or mysql.php;)

Sanitize-> clean

Finally, the Sanitize - clean method was brought back to normal. Previously, it was non-configurable and cut everything that is possible in arrays. Now the method has parameters. True, in the first version, the odd_spaces filter did not work due to a flaw in the initial version of the pre-beta, but thanks to the author of the article and the ticket system, the problem is resolved;)
So, now it’s easy to configure filters to clean arrays of debris.
Consider an example:

uses ('sanitize');
$ sanitize = new Sanitize ();
$ options = array (
'connection' => 'default',
'odd_spaces' => true,
' encode '=> false,
' dollar '=> true,
' carriage '=> true,
' unicode '=> true,
' escape '=> false,
' backslash '=> true
);
$ array = $ sanitize-> clean ($ array, $ options);

So, everything is simple. Set the parameters to be used as true, and the rest as false.
By the way, since we are talking about Sanitize, I will offer you a fairly logical design that quickly and simply protects the site.

Sanitize in Appcontroller

Since all incoming data from forms comes through $ this-> data, and there is an Appcontroller add-on above all controllers, it’s logical to scroll the following feint in beforeFilter:

class AppController extends Controller
{
var $ components = array ('RequestHandler');
var $ helpers = array ('javascript', 'ajax', 'navigation');

function beforeFilter () {
if (! empty ($ this-> data)) {
uses ('sanitize');
$ sanitize = new Sanitize ();
$ options = array (
'connection' => 'default',
'odd_spaces' => true,
' encode '=> false,
' dollar '=> true,
' carriage '=> true,
' unicode '=> true,
' escape '=> false,
' backslash '=> true
);
$ this-> data = $ sanitize-> clean ($ this-> data, $ options);

That's it, now all the data from the forms is cut automatically;) True, here a new feature of version 1.2 - named arguments gets in the way of the true.

Named arguments

The new named args feature is a way to transmit information through GET requests, i.e. through the query string using a router. Some simple variables that you need in any case, you can now pass like this:
cakephp.org/posts/index/page : 2 / sort: title
Accordingly, we have to create page variables somewhere with a value of 2 and sort with a value of title.
It turns out that they are very easy to get from the controller:

$ this-> passedArgs ['page'] ;.
$ this-> passedArgs ['sort'];

Here, however, a problem arises that I have not yet studied - what can be conveyed in this way? Is this a weak place in defense? If so, then passedArgs also makes sense to put it in sanitize so that it cleans these arguments well :)

Class set

This convenient feature will help to parse the whole array into one line, for example, $ this-> data.
Suppose you got the users table from the database. Accordingly, the data array looks like this:

$ users = array
(
0 => array
(
'User' => array
(
'id' => 1
, 'name' => 'Felix'
)
)
, 1 => array
(
'User' => array
(
'id' => 2
, 'name' => 'Bob'
)
)
, 2 => array
(
'User' => array
(
'id' => 3
, 'name' => 'Jim'
)
)
);

Want to get only usernames? Yes, easily:

$ userNames = Set :: extract ($ users, '{n} .User.name');

As you can see, {n} is a certain identifier of a scalar array. Accordingly, {n} can be placed in different places of the string, changing the location of this scalar array in the hierarchy of the array containing the scalar.
The class itself can be viewed separately, since the matter is not limited to extract alone. There is merge, diff, contains, normalize. In general, the help is always missing;), and the API is here:
trac.cakephp.org/browser/branches/1.2.xx/cake/libs/set.php

Manual

The manual for 1.2 was again returned to its place. True, there is still a lot of under-printing, but, apparently, it is constantly supplemented.
Open source in html form can be read here:
tempdocs.cakephp.org

We are waiting for your comments and suggestions. Also remember that the problems found can be left in the form of a ticket on the Kake website.