Question: I am just a newbie in cakephp and struggled a lot as a beginner, I hope im not exaggerating. I believe I was on the right track of coding a simple registration application when I found out that I am not able to insert any data in my database. The name of my database is "cake" and this is the default configuration:

```
public $default = array{
    'datasource'=>'Database/Mysql',
    'persistent'=>false,
    'host'=>'localhost',
    'login'=>'root',
    'password'=>'',
    'database'=>'cake',
    'schema'=>'',
    'prefix'=>''
}

```

By the way, the index page of my localhost says that I am connected to the database.

Answer: 
There exists a design pattern called [Front Controller](http://en.wikipedia.org/wiki/Front_Controller_pattern), basically what it does is the entire application is served through one page. You implement your own dispatcher and the dispatcher handles all the requests. Such as which object to instantiate or which page to include. This limits the security exploitation for unknown objects.

Also, for the Session hijacking you can implement your prevention mechanisms by monitoring and checking for

1. User Agent
2. Session regenerate id
3. Tokens

The database part is fairly impressive but **may add** additional complexities if someone else has to extend, debug your application. You can use [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php) or even a better alternative an [ORM](http://en.wikipedia.org/wiki/Object-relational_mapping) such as [Doctrine](http://www.doctrine-project.org) or [Data Objects](http://php.net/manual/en/book.pdo.php).

The major security exploits are through XSS and CSRF for that you will have to implement token passing mechanism within your forms and check for " origin of request".

Lastly, i would like to point out there are various security exploits possible in an web application. To counter these exploits lots of good frameworks exist. These issues and vulnerabilities are pre-dealt there. You can consider on the bussiness logic and let someone else handle that for you. Contrary to popular belief using frameworks will actually steepen your growth over the architectures, security and requests.

Hope this help !! cheers !
No, don't make your application one giant file.

Put your DB credentials in an include outside of the web root. Then, make sure only the users that need it can open it. That's how this is generally done.