What is the “right” way to collect $ _POST input from my form through CodeIgniter / PHP?

Question

This is a theoretical question rather than a specific one.

I have a form configured with the CodeIgniter form validation class. I follow some rules, for example:

$this->form_validation->set_rules('address_line_1', 'Address Line 1', 'required|xss_clean|trim');

Ultimately, I want to put the address_line_1 data in my database. Here I am a little confused. There seem to be several ways to retrieve $_POST data from CodeIgniter:

• $address = $_POST['address_line_1'];

• $address = $this->input->post('address_line_1');

• $address = $this->form_validation->set_value('address_line_1');

• $address = set_value('address_line_1);

So what is the "right" path?

Although I am sure that some of these assumptions are wrong, I was led to believe that ...

• $_POST parsed by CodeIgniter protection (I'm sure of that)

• $this->input->post() will sanitize the data (to a certain extent), but will not apply any rules for the preliminary preparation of the form.

• $this->form_validation->set_value() same as set_value() , but ...

• ... set_value() intended for repeated filling of form inputs through their element value="" .

Which of my assumptions are true and which are wrong? And how should I look for $_POST data when I prepare it using form validation? The form validation documentation is mixed when it comes to this. None of the examples ever shows that it actually passes input to the model, for example.

Thanks!

Jack

Answer 1

They are all different, otherwise they will not exist.

• $_POST['foo'] is unprotected and unprocessed. BADLY. Dont touch. etc.
• $this->input->post('foo') shielded and XSSified input. The default is FALSE instead of an error.
• $this->form_validation->set_value() this will test the output, which can be changed using validation rules. For example, if you add “trim” as a validation rule, the checked content will be truncated.
• set_value() just an alias of the method above. People do not like to use $ this in their views.

This is all in the documentation.