cakephp - sql注入测试总是显示失败

$this->loadModel('User');
$query = $this->User->find()
    ->where(['username' => $username])
    ->andWhere(['password' => $password])
    ->execute();

// 在User模型中定义验证规则
public $validate = [
    'username' => [
        'rule' => 'notEmpty',
        'message' => 'Username cannot be empty'
    ],
    'password' => [
        'rule' => 'notEmpty',
        'message' => 'Password cannot be empty'
    ]
];

// 在控制器中进行验证
$this->loadModel('User');
$user = $this->User->newEntity($this->request->getData());
if ($this->User->save($user)) {
    // 保存用户数据
} else {
    // 验证失败，处理错误信息
    $errors = $user->getErrors();
}

$this->loadModel('User');
$user = $this->User->findByUsernameAndPassword($username, $password)->first();