Take the 2-minute tour ×

I'm going through the documentation of Code Igniter and want to know if I get this right :

  • Use $this->input->post(x,TRUE) instead of $_POST every time

  • Best to use PDO. If not, do $this->security->xss_clean() and then $this->db->escape() before querying.

  • Use bcrypt instead of their encryption system

Also, to repopulate a form can I just put the post(x,TRUE) in the value="" field of the input or do I have to put it through prep_for_form() ?

They should really write a documentation about how to handle data with CodeIgniter.

EDIT : Apparently CodeIgniter's ActiveRecords already escape everything so no need to use db->escape()...

EDIT2 : Apparently form_validation escapes as well. So doing a htmlspecialchars after having done a form_validation does double escaping... I've posted this issue here : https://github.com/EllisLab/CodeIgniter/issues/2230

share|improve this question
For form repopulation, take a look at the set_value() et al. helper functions –  gregory Feb 5 '13 at 19:50
@gregory I'm using twig for views so no set_value(). –  David 天宇 Wong Feb 5 '13 at 19:59
I maintain that xss_clean should not be really used because it is not implemented properly; XSS is output problem and should be solved via filtering not input sanatization, that can cause some problems, I'd just use htmlentities() instead in output where necessary –  cyber-guard Feb 5 '13 at 21:38
@Cyber-GuardEnterprise htmlentities gives me &quot;&gt; in my form inputs instead of what the user typed. –  David 天宇 Wong Feb 5 '13 at 21:48
which is the point isn't it, what if person decided to close your form inputs and insert additional html, or additional html attributes; I mean that's the purpose of htmlentities... If you need to allow certain special characters, the function accommodates for that, but you shouldn't allow user output <> or " unless you exactly know what is going on and realize all the implications –  cyber-guard Feb 5 '13 at 21:54
show 1 more comment

1 Answer

1) Yes, otherwise you can enable global XSS filtering in your config.php file so accessing parameters with the input method will always be escaped.

2) CodeIgniter's Query Builder already does escaping, you will only need to use the $this->db->escape() function if you are writing your own SQL queries with the driver (for example, $this->db->query("SELECT * FROM users WHERE id = '" . $this->db->escape($this->input->post('id')) . "' LIMIT 1");

3) Use Bcrypt. If you have PHP 5.3.7+ then you can use this library which will provide forwards compatibility with the built-in Bcrypt functions in PHP 5.5.

share|improve this answer
If I understand correctly XSS filtering != Escaping. I think you can write <b>something</b> and it would output bold text. –  David 天宇 Wong Feb 23 '13 at 13:42
as for the library. Ion_auth seems to use bcrpyt as well. And it's well supported by the git community. –  David 天宇 Wong Feb 23 '13 at 13:43
XSS Filtering is not escaping, correct. XSS filtering prevents scripts from being injected via input, escaping is preventing input from being interpreted as code and run on the server, like in the database. –  Dwight Apr 11 '13 at 8:19
add comment

Your Answer


