CakePHP-生成不带撇号的SQL更新语句

Question

I'm trying to call updateAll function on Model and update text column but CakePHP doesn't add apostrophes to SQL command.

Is there any special setting to make it active? Is it necessary to do sanitization manually?

I'm using CakePHP 2.3 and MySQL 5.1

CakePHP

$this->User->updateAll(
        array('User.about_me' => $about),
        array('User.id' => $id)             
);

SQL command

UPDATE `test`.`users` AS `User` 
SET `User`.`about_me` = Nunc posuere risus sed elit ornare malesuada.  
WHERE `User`.`id` = 8956954 

Answer 1

Yes, this one is a little unexpected, but if you open cookbook and read about updateAll , it is clearly stated, that "Literal values should be quoted manually using DboSource::value() ". Or if you don't use user input, you can quote it yourself like: array('User.state' => "'active'")

More here