Gitiles
Code Review Sign In
www.giggi.me / code-igniter-v3-giggi / 779c0fb48ce7cb5e13435073bcc12036d1189041 / . / user_guide / libraries / input.html
blob: 0878f9d1e2251d94ab46aaeb49e63612a413cc40 [file] [log] [blame]
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html>
3<head>
4
5<title>Code Igniter User Guide</title>
6
7<style type='text/css' media='all'>@import url('../userguide.css');</style>
8<link rel='stylesheet' type='text/css' media='all' href='../userguide.css' />
9
10<script type="text/javascript" src="../scripts/nav.js"></script>
11<script type="text/javascript" src="../scripts/prototype.lite.js"></script>
12<script type="text/javascript" src="../scripts/moo.fx.js"></script>
13<script type="text/javascript">
14window.onload = function() {
15 myHeight = new fx.Height('nav', {duration: 400});
16 myHeight.hide();
17}
18</script>
19
20<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21<meta http-equiv='expires' content='-1' />
22<meta http-equiv= 'pragma' content='no-cache' />
23<meta name='robots' content='all' />
24<meta name='author' content='Rick Ellis' />
25<meta name='description' content='Code Igniter User Guide' />
26
27</head>
28<body>
29
30<!-- START NAVIGATION -->
31<div id="nav"><div id="nav_inner"><script type="text/javascript">create_menu('../');</script></div></div>
32<div id="nav2"><a name="top"></a><a href="javascript:void(0);" onclick="myHeight.toggle();"><img src="../images/nav_toggle.jpg" width="153" height="44" border="0" title="Toggle Table of Contents" alt="Toggle Table of Contents" /></a></div>
33<div id="masthead">
34<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
35<tr>
36<td><h1>Code Igniter User Guide Version 1.4.0</h1></td>
37<td id="breadcrumb_right"><a href="../toc.html">Full Table of Contents</a></td>
38</tr>
39</table>
40</div>
41<!-- END NAVIGATION -->
42
43
44<!-- START BREADCRUMB -->
45<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
46<tr>
47<td id="breadcrumb">
48<a href="http://www.codeigniter.com/">Code Igniter Home</a> &nbsp;&#8250;&nbsp;
49<a href="../index.html">User Guide Home</a> &nbsp;&#8250;&nbsp;
50Input and Security Class
51</td>
52<td id="searchbox"><form method="get" action="http://www.google.com/search"><input type="hidden" name="as_sitesearch" id="as_sitesearch" value="www.codeigniter.com/user_guide/" />Search User Guide&nbsp; <input type="text" class="input" style="width:200px;" name="q" id="q" size="31" maxlength="255" value="" />&nbsp;<input type="submit" class="submit" name="sa" value="Go" /></form></td>
53</tr>
54</table>
55<!-- END BREADCRUMB -->
56
57<br clear="all" />
58
59
60<!-- START CONTENT -->
61<div id="content">
62
63
64<h1>Input Class</h1>
65
66<p>The Input Class serves two purposes:</p>
67
68<ol>
69<li>It pre-processes global input data for security.</li>
70<li>It provides some helper functions for fetching input data and pre-processing it.</li>
71</ol>
72
73<p class="important"><strong>Note:</strong> This class is initialized automatically by the system so there is no need to do it manually.</p>
74
75
76<h2>Security Filtering</h2>
77
78<p>The security filtering function is called automatically when a new <a href="../general/controllers.html">controller</a> is invoked. It does the following:</p>
79
80<ul>
81<li>Destroys the global GET array. Since Code Igniter does not utilize GET strings, there is no reason to allow it.</li>
82<li>Destroys all global variables in the event register_globals is turned on.</li>
83<li>Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li>
84<li>Provides XSS (Cross-site Scripting Hacks) filtering. This can be enabled globally, or upon request.</li>
85<li>Standardizes newline characters to \n</li>
86</ul>
87
88
89<h2>XSS Filtering</h2>
90
91<p>Code Igniter comes with a Cross Site Scripting Hack prevention filter which can either run automatically to filter
92all POST and COOKIE data that is encountered, or you can run it on a per item basis. By default it does <strong>not</strong>
93run globally since it requires a bit of processing overhead, and since you may not need it in all cases.</p>
94
95<p>The XSS filter looks for commonly used techniques to trigger Javascript or other types of code that attempt to hijack cookies
96or do other malicious things. If anything disallowed is encountered it is rendered safe by converting the data to character entities.</p>
97
98<p>
99Note: This function should only be used to deal with data upon submission. It's not something that should be used for general runtime processing since it requires a fair amount of processing overhead.</p>
100
101
102<p>To filter data through the XSS filter use this function:</p>
103
104<h2>$this->input->xss_clean()</h2>
105
106<p>Here is an usage example:</p>
107
108<code>$data = $this->input->xss_clean($data);</code>
109
110<p>If you want the filter to run automatically every time it encounters POST or COOKIE data you can enable it by opening your
111<kbd>application/config/config.php</kbd> file and setting this:
112
113<code>$config['global_xss_filtering'] = TRUE;</code>
114
115<p>Note: If you use the form validation class, it gives you the option of XSS filtering as well.</p>
116
117
118
119
120<h2>Using POST or COOKIE Data</h2>
121
122<p>Code Igniter comes with two helper functions that let you fetch POST or COOKIE items. The main advantage of using the provided
123functions rather then fetching an item directly ($_POST['something']) is that the functions will check to see if the item is set and
124return false (boolean) if not. This lets you conveniently use data without having to test whether an item exists first.
125In other words, normally you might do something like this:
126
127<code>
128if ( ! isset($_POST['something']))<br />
129{<br />
130&nbsp;&nbsp;&nbsp;&nbsp;$something = FALSE;<br />
131}<br />
132else<br />
133{<br />
134&nbsp;&nbsp;&nbsp;&nbsp;$something = $_POST['something'];<br />
135}</code>
136
137<p>With Code Igniter's built in functions you can simply do this:</p>
138
139<code>$something = $this->input->post('something');</code>
140
141<p>The two functions are:</p>
142
143<h2>$this->input->post()</h2>
144
145<p>The first parameter will contain the name of the POST item you are looking for:</p>
146
147<code>$this->input->post('some_data');</code>
148
149<p>The function returns FALSE (boolean) if the item you are attempting to retrieve does not exist.</p>
150
151<p>The second optional parameter lets you run the data through the XSS filter. It's enabled by setting the second parameter to boolean TRUE;</p>
152
153<code>$this->input->post('some_data', TRUE);</code>
154
155<h2>$this->input->cookie()</h2>
156
157<p>This function is identical to the post function, only it fetches cookie data:</p>
158
159<code>$this->input->cookie('some_data', TRUE);</code>
160
161
162
163
164<h2>$this->input->ip_address()</h2>
165<p>Returns the IP address for the current user. If the IP address is not valid, the function will return an IP of: 0.0.0.0</p>
166<code>echo $this->input->ip_address();</code>
167
168
169<h2>$this->input->valid_ip(<var>$ip</var>)</h2>
170
171<p>Takes an IP address as input and returns TRUE or FALSE (boolean) if it is valid or not. Note: The $this->input->ip_address() function above
172validates the IP automatically.</p>
173
174<code>if ( ! valid_id($ip))<br />
175{<br />
176&nbsp;&nbsp;&nbsp;&nbsp; echo 'Not Valid';<br />
177}<br />
178else<br />
179{<br />
180&nbsp;&nbsp;&nbsp;&nbsp; echo 'Valid';<br />
181}</code>
182
183
184<h2>$this->input->user_agent()</h2>
185<p>Returns the user agent (web browser) being used by the current user. Returns FALSE if it's not available.</p>
186<code>echo $this->input->user_agent();</code>
187
188
189
190
191</div>
192<!-- END CONTENT -->
193
194
195<div id="footer">
196<p>
197Previous Topic:&nbsp;&nbsp;<a href="image_lib.html">Image Manipulation Class</a>
198&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
199<a href="#top">Top of Page</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
200<a href="../index.html">User Guide Home</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
201Next Topic:&nbsp;&nbsp;<a href="loader.html">Loader Class</a>
202<p>
203<p><a href="http://www.codeigniter.com">Code Igniter</a> &nbsp;&middot;&nbsp; Copyright &#169; 2006 &nbsp;&middot;&nbsp; <a href="http://www.pmachine.com">pMachine, Inc.</a></p>
204</div>
205
206</body>
207</html>