title: How to prevent SQL injection in PhalconPHP when using sql in model?
body: <p>Let's say I am building a search that finds all the teacher and got an input where the user can put in the search term. I tried reading the phalcon documentation but I only see things like binding parameters. I read the other thread about needing prepare statements do I need that in Phalcon as well?</p>
  
  <p>And my function in the model would be something like this:</p>
  
  <pre><code>public function findTeachers($q, $userId, $isUser, $page, $limit, $sort)
  {
    $sql =  'SELECT id FROM tags WHERE name LIKE "%' . $q . '%"';
    $result = new Resultset(null, $this,
    $this-&gt;getReadConnection()-&gt;query($sql, array()));
    $tagResult = $result-&gt;toArray();
    $tagList = array();
    foreach ($tagResult as $key =&gt; $value) {
       $tagList[] = $value['id'];
    ....
  
    }
  }
  </code></pre>
  
  <p>My question is for the Phalcon framework is there any settings or formats I should code for this line <code>$sql =  'SELECT id FROM tags WHERE name LIKE "%' . $q . '%"';</code></p>
  
  <p>And also any general recommendation for preventing SQL Injection in PhalconPHP controllers and index would be appreciated. </p>
  
  <p>For reference:</p>
  
  <p>My controller:</p>
  
  <pre><code>public function searchAction()
  {
      $this-&gt;view-&gt;disable();
      $q = $this-&gt;request-&gt;get("q");
      $sort = $this-&gt;request-&gt;get("sort");
      $searchUserModel = new SearchUsers();
      $loginUser = $this-&gt;component-&gt;user-&gt;getSessionUser();
      if (!$loginUser) {
        $loginUser = new stdClass;
        $loginUser-&gt;id = '';
      }
      $page = $this-&gt;request-&gt;get("page");
      $limit = 2;
      if (!$page){
          $page = 1;
      }
  
      $list = $searchUserModel-&gt;findTeachers($q, $loginUser-&gt;id, ($loginUser-&gt;id)?true:false, $page, $limit, $sort);
  
      if ($list){
          $list['status'] = true;
      }
      echo json_encode($list);
  }
  </code></pre>
  
  <p>My Ajax:</p>
  
  <pre><code>function(cb){
      $.ajax({
          url: '/search/search?q=' + mapObject.q + '&amp;sort=&lt;?php echo $sort;?&gt;' +  '&amp;page=' + mapObject.page,
          data:{},
          success: function(res) {
              //console.log(res);
              var result = JSON.parse(res);
              if (!result.status){
                  return cb(null, result.list);
              }else{
                  return cb(null, []);
              }
          },
          error: function(xhr, ajaxOptions, thrownError) {
              cb(null, []);
           }
  });
  </code></pre>
  
  <p>with q being the user's search term.</p>