title: CakePhp: Avoid XSS attack keeping the ease of use of cake
body: <p>One of the things I like with cakePhp, is that we can easily have a generated edited form which allows us to save.</p>
  
  <p>E.g. in a controller:</p>
  
  <pre><code>function add() {
          if (!empty($this-&gt;data)) {
              $this-&gt;Post-&gt;create();
              if ($this-&gt;Post-&gt;save($this-&gt;data)) {
                  $this-&gt;Session-&gt;setFlash(__('The post has been saved', true));
                  $this-&gt;redirect(array('action' =&gt; 'index'));
              } else {
                  $this-&gt;Session-&gt;setFlash(__('The post could not be saved. Please, try again.', true));
              }
          }
          $users = $this-&gt;Post-&gt;User-&gt;find('list');
          $this-&gt;set(compact('users'));
      }
  </code></pre>
  
  <p>The problem with that is that our fields are vulnerable to XSS (Cross site scripting). I'm aware of the "Sanitize::Clean" way, but I've a problem with that: it's mean that we have to do this on all fields before with save the object. And what if once we add one field? We should go on all our code to check that we sanitize it?? Is there any way to say "Sanitize this object before save it", without specifing any fields?</p>
  
  <p>Thank you!</p>