Question: I am just a newbie in cakephp and struggled a lot as a beginner, I hope im not exaggerating. I believe I was on the right track of coding a simple registration application when I found out that I am not able to insert any data in my database. The name of my database is "cake" and this is the default configuration:

```
public $default = array{
    'datasource'=>'Database/Mysql',
    'persistent'=>false,
    'host'=>'localhost',
    'login'=>'root',
    'password'=>'',
    'database'=>'cake',
    'schema'=>'',
    'prefix'=>''
}

```

By the way, the index page of my localhost says that I am connected to the database.

Answer: 
You should never need to store passwords in the session and there is no need to create individual MySQL users for each user of your application. These things don't make your application more secure and could actually make it less secure.

Here are some suggestions:

* Create one MySQL user with only the necessary permissions to read the data you need.
* Store the MySQL connection information in a PHP file that is outside the document root and include this file in your PHP files that need access to the database.
* Create a table in the database to store user accounts and always hash their password before saving it to the table. You can use this table to authenticate your users when they sign in.
* When the user signs in, simply store a flag in the session, like their user\_id. This is enough to identify who they are and that they are signed in. If the value is not in the session, then they are not signed in.
* You don't need to put everything in one PHP file. It's OK to have more than one file.

You may want to try using a framework, like Symfony, CodeIgniter, or CakePHP because they will have tutorials that can help you create a secure application. Keep in mind that security goes beyond just passwords. As Kishor points out, you also need to worry about XSS, SQL injection, CSRF, etc. A framework will really help you out with these things.
No, don't make your application one giant file.

Put your DB credentials in an include outside of the web root. Then, make sure only the users that need it can open it. That's how this is generally done.