Gitiles
Code Review Sign In
www.giggi.me / code-igniter-v3-giggi / 8dbc121ed01ff4b6285b56cdf8bc37e363743d28 / . / user_guide / libraries / input.html
blob: 4e5ac3b7fcbdb351ba7ad3d8ec805349636c11aa [file] [log] [blame]
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html>
3<head>
4
5<title>Code Igniter User Guide</title>
6
7<style type='text/css' media='all'>@import url('../userguide.css');</style>
8<link rel='stylesheet' type='text/css' media='all' href='../userguide.css' />
9
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]10<script type="text/javascript" src="../nav/nav.js"></script>
admin2296fc32006-09-27 21:07:02 +0000[diff] [blame]11<script type="text/javascript" src="../nav/prototype.lite.js"></script>
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]12<script type="text/javascript" src="../nav/moo.fx.js"></script>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]13<script type="text/javascript">
14window.onload = function() {
15 myHeight = new fx.Height('nav', {duration: 400});
16 myHeight.hide();
17}
18</script>
19
20<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21<meta http-equiv='expires' content='-1' />
22<meta http-equiv= 'pragma' content='no-cache' />
23<meta name='robots' content='all' />
24<meta name='author' content='Rick Ellis' />
25<meta name='description' content='Code Igniter User Guide' />
26
27</head>
28<body>
29
30<!-- START NAVIGATION -->
31<div id="nav"><div id="nav_inner"><script type="text/javascript">create_menu('../');</script></div></div>
32<div id="nav2"><a name="top"></a><a href="javascript:void(0);" onclick="myHeight.toggle();"><img src="../images/nav_toggle.jpg" width="153" height="44" border="0" title="Toggle Table of Contents" alt="Toggle Table of Contents" /></a></div>
33<div id="masthead">
34<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
35<tr>
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]36<td><h1>Code Igniter User Guide Version 1.5.0b1</h1></td>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]37<td id="breadcrumb_right"><a href="../toc.html">Full Table of Contents</a></td>
38</tr>
39</table>
40</div>
41<!-- END NAVIGATION -->
42
43
44<!-- START BREADCRUMB -->
45<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
46<tr>
47<td id="breadcrumb">
48<a href="http://www.codeigniter.com/">Code Igniter Home</a> &nbsp;&#8250;&nbsp;
49<a href="../index.html">User Guide Home</a> &nbsp;&#8250;&nbsp;
50Input and Security Class
51</td>
52<td id="searchbox"><form method="get" action="http://www.google.com/search"><input type="hidden" name="as_sitesearch" id="as_sitesearch" value="www.codeigniter.com/user_guide/" />Search User Guide&nbsp; <input type="text" class="input" style="width:200px;" name="q" id="q" size="31" maxlength="255" value="" />&nbsp;<input type="submit" class="submit" name="sa" value="Go" /></form></td>
53</tr>
54</table>
55<!-- END BREADCRUMB -->
56
57<br clear="all" />
58
59
60<!-- START CONTENT -->
61<div id="content">
62
63
64<h1>Input Class</h1>
65
66<p>The Input Class serves two purposes:</p>
67
68<ol>
69<li>It pre-processes global input data for security.</li>
70<li>It provides some helper functions for fetching input data and pre-processing it.</li>
71</ol>
72
73<p class="important"><strong>Note:</strong> This class is initialized automatically by the system so there is no need to do it manually.</p>
74
75
76<h2>Security Filtering</h2>
77
78<p>The security filtering function is called automatically when a new <a href="../general/controllers.html">controller</a> is invoked. It does the following:</p>
79
80<ul>
81<li>Destroys the global GET array. Since Code Igniter does not utilize GET strings, there is no reason to allow it.</li>
82<li>Destroys all global variables in the event register_globals is turned on.</li>
83<li>Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li>
84<li>Provides XSS (Cross-site Scripting Hacks) filtering. This can be enabled globally, or upon request.</li>
85<li>Standardizes newline characters to \n</li>
86</ul>
87
88
89<h2>XSS Filtering</h2>
90
91<p>Code Igniter comes with a Cross Site Scripting Hack prevention filter which can either run automatically to filter
92all POST and COOKIE data that is encountered, or you can run it on a per item basis. By default it does <strong>not</strong>
93run globally since it requires a bit of processing overhead, and since you may not need it in all cases.</p>
94
95<p>The XSS filter looks for commonly used techniques to trigger Javascript or other types of code that attempt to hijack cookies
96or do other malicious things. If anything disallowed is encountered it is rendered safe by converting the data to character entities.</p>
97
98<p>
99Note: This function should only be used to deal with data upon submission. It's not something that should be used for general runtime processing since it requires a fair amount of processing overhead.</p>
100
101
102<p>To filter data through the XSS filter use this function:</p>
103
104<h2>$this->input->xss_clean()</h2>
105
106<p>Here is an usage example:</p>
107
108<code>$data = $this->input->xss_clean($data);</code>
109
110<p>If you want the filter to run automatically every time it encounters POST or COOKIE data you can enable it by opening your
111<kbd>application/config/config.php</kbd> file and setting this:
112
113<code>$config['global_xss_filtering'] = TRUE;</code>
114
115<p>Note: If you use the form validation class, it gives you the option of XSS filtering as well.</p>
116
117
118
119
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]120<h2>Using POST, COOKIE, or SERVER Data</h2>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]121
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]122<p>Code Igniter comes with three helper functions that let you fetch POST, COOKIE or SERVER items. The main advantage of using the provided
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]123functions rather then fetching an item directly ($_POST['something']) is that the functions will check to see if the item is set and
124return false (boolean) if not. This lets you conveniently use data without having to test whether an item exists first.
125In other words, normally you might do something like this:
126
127<code>
128if ( ! isset($_POST['something']))<br />
129{<br />
130&nbsp;&nbsp;&nbsp;&nbsp;$something = FALSE;<br />
131}<br />
132else<br />
133{<br />
134&nbsp;&nbsp;&nbsp;&nbsp;$something = $_POST['something'];<br />
135}</code>
136
137<p>With Code Igniter's built in functions you can simply do this:</p>
138
139<code>$something = $this->input->post('something');</code>
140
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]141<p>The three functions are:</p>
142
143<ul>
144<li>$this->input->post()</li>
145<li>$this->input->cookie()</li>
146<li>$this->input->server()</li>
147</ul>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]148
149<h2>$this->input->post()</h2>
150
151<p>The first parameter will contain the name of the POST item you are looking for:</p>
152
153<code>$this->input->post('some_data');</code>
154
155<p>The function returns FALSE (boolean) if the item you are attempting to retrieve does not exist.</p>
156
157<p>The second optional parameter lets you run the data through the XSS filter. It's enabled by setting the second parameter to boolean TRUE;</p>
158
159<code>$this->input->post('some_data', TRUE);</code>
160
161<h2>$this->input->cookie()</h2>
162
163<p>This function is identical to the post function, only it fetches cookie data:</p>
164
165<code>$this->input->cookie('some_data', TRUE);</code>
166
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]167<h2>$this->input->server()</h2>
168
169<p>This function is identical to the above functions, only it fetches server data:</p>
170
171<code>$this->input->server('some_data');</code>
172
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]173
174
175
176<h2>$this->input->ip_address()</h2>
177<p>Returns the IP address for the current user. If the IP address is not valid, the function will return an IP of: 0.0.0.0</p>
178<code>echo $this->input->ip_address();</code>
179
180
181<h2>$this->input->valid_ip(<var>$ip</var>)</h2>
182
183<p>Takes an IP address as input and returns TRUE or FALSE (boolean) if it is valid or not. Note: The $this->input->ip_address() function above
184validates the IP automatically.</p>
185
186<code>if ( ! valid_id($ip))<br />
187{<br />
188&nbsp;&nbsp;&nbsp;&nbsp; echo 'Not Valid';<br />
189}<br />
190else<br />
191{<br />
192&nbsp;&nbsp;&nbsp;&nbsp; echo 'Valid';<br />
193}</code>
194
195
196<h2>$this->input->user_agent()</h2>
197<p>Returns the user agent (web browser) being used by the current user. Returns FALSE if it's not available.</p>
198<code>echo $this->input->user_agent();</code>
199
200
201
202
203</div>
204<!-- END CONTENT -->
205
206
207<div id="footer">
208<p>
209Previous Topic:&nbsp;&nbsp;<a href="image_lib.html">Image Manipulation Class</a>
210&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
211<a href="#top">Top of Page</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
212<a href="../index.html">User Guide Home</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
213Next Topic:&nbsp;&nbsp;<a href="loader.html">Loader Class</a>
214<p>
215<p><a href="http://www.codeigniter.com">Code Igniter</a> &nbsp;&middot;&nbsp; Copyright &#169; 2006 &nbsp;&middot;&nbsp; <a href="http://www.pmachine.com">pMachine, Inc.</a></p>
216</div>
217
218</body>
219</html>