Gitiles
Code Review Sign In
www.giggi.me / code-igniter-v3-giggi / 903cc985da13463369a4cb1831ccbe5449316ee7 / . / user_guide / libraries / input.html
blob: cb91bf1c2176025275c2d5770e753ea01e9fc771 [file] [log] [blame]
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
Derek Allardafd99ac2008-01-19 19:59:14 +0000[diff] [blame]2<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]3<head>
4
Derek Allard404e35d2007-08-07 01:00:45 +0000[diff] [blame]5<title>CodeIgniter User Guide : Input Class</title>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]6
7<style type='text/css' media='all'>@import url('../userguide.css');</style>
8<link rel='stylesheet' type='text/css' media='all' href='../userguide.css' />
9
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]10<script type="text/javascript" src="../nav/nav.js"></script>
admin2296fc32006-09-27 21:07:02 +0000[diff] [blame]11<script type="text/javascript" src="../nav/prototype.lite.js"></script>
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]12<script type="text/javascript" src="../nav/moo.fx.js"></script>
Derek Allardb3412372007-10-25 12:15:16 +0000[diff] [blame]13<script type="text/javascript" src="../nav/user_guide_menu.js"></script>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]14
15<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
16<meta http-equiv='expires' content='-1' />
17<meta http-equiv= 'pragma' content='no-cache' />
18<meta name='robots' content='all' />
Derek Allard3d879d52008-01-18 19:41:32 +0000[diff] [blame]19<meta name='author' content='ExpressionEngine Dev Team' />
Derek Allardd2df9bc2007-04-15 17:41:17 +0000[diff] [blame]20<meta name='description' content='CodeIgniter User Guide' />
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]21
22</head>
23<body>
24
25<!-- START NAVIGATION -->
26<div id="nav"><div id="nav_inner"><script type="text/javascript">create_menu('../');</script></div></div>
27<div id="nav2"><a name="top"></a><a href="javascript:void(0);" onclick="myHeight.toggle();"><img src="../images/nav_toggle.jpg" width="153" height="44" border="0" title="Toggle Table of Contents" alt="Toggle Table of Contents" /></a></div>
28<div id="masthead">
29<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
30<tr>
Derek Allard067f2cc2008-02-04 22:12:03 +0000[diff] [blame]31<td><h1>CodeIgniter User Guide Version 1.6.1</h1></td>
adminc0d5d522006-10-30 19:40:35 +0000[diff] [blame]32<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]33</tr>
34</table>
35</div>
36<!-- END NAVIGATION -->
37
38
39<!-- START BREADCRUMB -->
40<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
41<tr>
42<td id="breadcrumb">
Derek Jones7a9193a2008-01-21 18:39:20 +0000[diff] [blame]43<a href="http://codeigniter.com/">CodeIgniter Home</a> &nbsp;&#8250;&nbsp;
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]44<a href="../index.html">User Guide Home</a> &nbsp;&#8250;&nbsp;
45Input and Security Class
46</td>
Derek Allardbc030912007-06-24 18:25:29 +0000[diff] [blame]47<td id="searchbox"><form method="get" action="http://www.google.com/search"><input type="hidden" name="as_sitesearch" id="as_sitesearch" value="codeigniter.com/user_guide/" />Search User Guide&nbsp; <input type="text" class="input" style="width:200px;" name="q" id="q" size="31" maxlength="255" value="" />&nbsp;<input type="submit" class="submit" name="sa" value="Go" /></form></td>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]48</tr>
49</table>
50<!-- END BREADCRUMB -->
51
52<br clear="all" />
53
54
55<!-- START CONTENT -->
56<div id="content">
57
58
59<h1>Input Class</h1>
60
61<p>The Input Class serves two purposes:</p>
62
63<ol>
64<li>It pre-processes global input data for security.</li>
65<li>It provides some helper functions for fetching input data and pre-processing it.</li>
66</ol>
67
68<p class="important"><strong>Note:</strong> This class is initialized automatically by the system so there is no need to do it manually.</p>
69
70
71<h2>Security Filtering</h2>
72
73<p>The security filtering function is called automatically when a new <a href="../general/controllers.html">controller</a> is invoked. It does the following:</p>
74
75<ul>
Derek Allardd2df9bc2007-04-15 17:41:17 +0000[diff] [blame]76<li>Destroys the global GET array. Since CodeIgniter does not utilize GET strings, there is no reason to allow it.</li>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]77<li>Destroys all global variables in the event register_globals is turned on.</li>
78<li>Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li>
79<li>Provides XSS (Cross-site Scripting Hacks) filtering. This can be enabled globally, or upon request.</li>
80<li>Standardizes newline characters to \n</li>
81</ul>
82
83
84<h2>XSS Filtering</h2>
85
Derek Allardd2df9bc2007-04-15 17:41:17 +0000[diff] [blame]86<p>CodeIgniter comes with a Cross Site Scripting Hack prevention filter which can either run automatically to filter
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]87all POST and COOKIE data that is encountered, or you can run it on a per item basis. By default it does <strong>not</strong>
88run globally since it requires a bit of processing overhead, and since you may not need it in all cases.</p>
89
90<p>The XSS filter looks for commonly used techniques to trigger Javascript or other types of code that attempt to hijack cookies
91or do other malicious things. If anything disallowed is encountered it is rendered safe by converting the data to character entities.</p>
92
93<p>
94Note: This function should only be used to deal with data upon submission. It's not something that should be used for general runtime processing since it requires a fair amount of processing overhead.</p>
95
96
97<p>To filter data through the XSS filter use this function:</p>
98
99<h2>$this->input->xss_clean()</h2>
100
101<p>Here is an usage example:</p>
102
103<code>$data = $this->input->xss_clean($data);</code>
104
admine334c472006-10-21 19:44:22 +0000[diff] [blame]105<p>If you want the filter to run automatically every time it encounters POST or COOKIE data you can enable it by opening your
Derek Allardc6441282007-07-04 23:54:32 +0000[diff] [blame]106<kbd>application/config/config.php</kbd> file and setting this:</p>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]107
108<code>$config['global_xss_filtering'] = TRUE;</code>
109
110<p>Note: If you use the form validation class, it gives you the option of XSS filtering as well.</p>
111
112
113
114
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]115<h2>Using POST, COOKIE, or SERVER Data</h2>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]116
Derek Allardd2df9bc2007-04-15 17:41:17 +0000[diff] [blame]117<p>CodeIgniter comes with three helper functions that let you fetch POST, COOKIE or SERVER items. The main advantage of using the provided
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]118functions rather then fetching an item directly ($_POST['something']) is that the functions will check to see if the item is set and
admine334c472006-10-21 19:44:22 +0000[diff] [blame]119return false (boolean) if not. This lets you conveniently use data without having to test whether an item exists first.
Derek Allardc6441282007-07-04 23:54:32 +0000[diff] [blame]120In other words, normally you might do something like this:</p>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]121
122<code>
123if ( ! isset($_POST['something']))<br />
124{<br />
125&nbsp;&nbsp;&nbsp;&nbsp;$something = FALSE;<br />
126}<br />
127else<br />
128{<br />
129&nbsp;&nbsp;&nbsp;&nbsp;$something = $_POST['something'];<br />
130}</code>
131
Derek Allardd2df9bc2007-04-15 17:41:17 +0000[diff] [blame]132<p>With CodeIgniter's built in functions you can simply do this:</p>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]133
134<code>$something = $this->input->post('something');</code>
135
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]136<p>The three functions are:</p>
137
138<ul>
139<li>$this->input->post()</li>
140<li>$this->input->cookie()</li>
141<li>$this->input->server()</li>
142</ul>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]143
144<h2>$this->input->post()</h2>
145
146<p>The first parameter will contain the name of the POST item you are looking for:</p>
147
148<code>$this->input->post('some_data');</code>
149
150<p>The function returns FALSE (boolean) if the item you are attempting to retrieve does not exist.</p>
151
152<p>The second optional parameter lets you run the data through the XSS filter. It's enabled by setting the second parameter to boolean TRUE;</p>
153
154<code>$this->input->post('some_data', TRUE);</code>
155
156<h2>$this->input->cookie()</h2>
157
158<p>This function is identical to the post function, only it fetches cookie data:</p>
159
160<code>$this->input->cookie('some_data', TRUE);</code>
161
admin10c3f412006-10-08 07:21:12 +0000[diff] [blame]162<h2>$this->input->server()</h2>
163
164<p>This function is identical to the above functions, only it fetches server data:</p>
165
166<code>$this->input->server('some_data');</code>
167
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]168
169
170
171<h2>$this->input->ip_address()</h2>
172<p>Returns the IP address for the current user. If the IP address is not valid, the function will return an IP of: 0.0.0.0</p>
173<code>echo $this->input->ip_address();</code>
174
175
176<h2>$this->input->valid_ip(<var>$ip</var>)</h2>
177
178<p>Takes an IP address as input and returns TRUE or FALSE (boolean) if it is valid or not. Note: The $this->input->ip_address() function above
179validates the IP automatically.</p>
180
Rick Ellisfc38dea2007-01-09 19:47:05 +0000[diff] [blame]181<code>if ( ! valid_ip($ip))<br />
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]182{<br />
183&nbsp;&nbsp;&nbsp;&nbsp; echo 'Not Valid';<br />
184}<br />
185else<br />
186{<br />
187&nbsp;&nbsp;&nbsp;&nbsp; echo 'Valid';<br />
188}</code>
189
190
191<h2>$this->input->user_agent()</h2>
192<p>Returns the user agent (web browser) being used by the current user. Returns FALSE if it's not available.</p>
193<code>echo $this->input->user_agent();</code>
194
195
196
197
198</div>
199<!-- END CONTENT -->
200
201
202<div id="footer">
203<p>
204Previous Topic:&nbsp;&nbsp;<a href="image_lib.html">Image Manipulation Class</a>
205&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
206<a href="#top">Top of Page</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
207<a href="../index.html">User Guide Home</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
208Next Topic:&nbsp;&nbsp;<a href="loader.html">Loader Class</a>
Derek Allardc6441282007-07-04 23:54:32 +0000[diff] [blame]209</p>
Derek Jones7a9193a2008-01-21 18:39:20 +0000[diff] [blame]210<p><a href="http://codeigniter.com">CodeIgniter</a> &nbsp;&middot;&nbsp; Copyright &#169; 2007 &nbsp;&middot;&nbsp; <a href="http://ellislab.com/">Ellislab, Inc.</a></p>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]211</div>
212
213</body>
214</html>