title: What is the best way to use mysql_real_escape_string and htmlspecialchars while saving data in CakePHP?
body: <p>I am using FCKEditor with CakePHP and when I save data sent from the editor I want to run the htmlspecialchars() and mysql_real_escape_string() functions on the data to clean it before I store it in my database.  The problem is I am not really sure where to do this within the CakePHP framework.  I tried in the controller like this:</p>
  
  <pre><code>function add() 
  {
     if (!empty($this-&gt;data)) 
     {
        if ($this-&gt;Article-&gt;save(mysql_real_escape_string(htmlspecialchars($this-&gt;data)))) 
        {
           $this-&gt;Session-&gt;setFlash('Your article has been saved.');
       $this-&gt;redirect(array('action' =&gt; 'index'));
        }
  
     }
  }
  </code></pre>
  
  <p>However $this->data is an array and those functions expect strings so that won't work.  Do I do it in the validate array of the model?  I have no idea.  Also, let me know if running htmlspecialchars() inside of mysql_real_escape_string() is not a good practice.</p>