CODEWITHSUNDEEP
phpsecuritycodeigniterpost
Jack
Jack

Reputation: 9784

What is the 'correct' way to gather $_POST input from my form via CodeIgniter/PHP?

This is more of a theoretical question than a specific one.

I have a form set up with CodeIgniter's Form Validation class. I have some rules being run, for example:

$this->form_validation->set_rules('address_line_1', 'Address Line 1', 'required|xss_clean|trim');

I eventually want to put the address_line_1 data into my Database. This is where I'm a little confused. It seems there are several ways of fetching $_POST data from within CodeIgniter:

  1. $address = $_POST['address_line_1'];

  2. $address = $this->input->post('address_line_1');

  3. $address = $this->form_validation->set_value('address_line_1');

  4. $address = set_value('address_line_1);

So which way is the 'correct' way?

Whilst I'm sure several of these assumptions are wrong, I've been led to believe that...

Which of my assumptions are correct and which are wrong? And what is the way I should be pulling through $_POST data when I'm prepping it with Form Validation? The Form Validation documentation is ambiguous when it comes to this. None of the examples ever show it actually passing input data onto a model, for example.

Thanks!

Jack

Upvotes: 4

Views: 998

Answers (1)

Phil Sturgeon
Phil Sturgeon

Reputation: 30766

They are all different, or they wouldn't all exist.

  1. $_POST['foo'] is unprotected and raw output. BAD. Don't touch. etc.
  2. $this->input->post('foo') escaped and XSSified input. Defaults to FALSE instead of erroring.
  3. $this->form_validation->set_value() this will take the validated output, which may have been modified through the validation rules. For example, if you add "trim" as a validation rule, the validated content will be trimmed.
  4. set_value() just an alias of the method above. People don't like to use $this in their views.

This is all in the documentation.

Upvotes: 13

Related Questions