Understanding Security Feature Relationships in CakePHP 3.x

1. Escape processing for SQL injection countermeasures
If the placeholder implementation is difficult, the value must be escaped, but
Does cakePHP have a function for escape processing?

The escape function does not appear to be in cakePHP.It seems that the policy is to use placeholders.In the case of algae, it seems that the only way to do this is to pull out PDO and DB drivers and use those escape functions directly.

I looked it up and found something called Model->find(), but is it common to use it?

find is the interface for searching.

2. About excluding script elements for XSS countermeasures

I think you can use PHP's DOMDocument.

3. About Cookie Settings
The httpOnly attribute is set to
Should I use CookieComponent httpOnly=>true?

Yes

4. Disable http method
To disable methods such as delete and trace
Should I use request->allowMethod?

Server-side restrictions.

5. About Response Header Settings
Content-Type, X-Content-Type-Options, and Content-Disposition settings are
Should I use the Cake\Http\Response class?

Yes

6. About line breaks for http header injection
Is there a function of cakePHP that checks line breaks and encodes percentages?

I think you can use the PHP function.

I have a general impression, but

• Read the reference carefully
• Try creating applications using the framework in tutorials, etc.
• Learn the basics of how web applications work and security

There is a lack of basic elements such as this, and I think it will be difficult to investigate the security relationship in development using the framework.