-
Some PHP functions return FALSE on failure, but may also have a valid return value of "" or 0, which would evaluate to FALSE in loose comparisons. Be explicit by comparing the variable type when using these return values in conditionals to ensure the return value is indeed what you expect, and not a value that has an equivalent loose-type evaluation.
-
Use the same stringency in returning and checking your own variables. Use === and !== as necessary.
+
Some PHP functions return FALSE on failure, but may also have a valid return value of "" or 0, which would evaluate to FALSE in loose comparisons. Be explicit by comparing the variable type when using these return values in conditionals to ensure the return value is indeed what you expect, and not a value that has an equivalent loose-type evaluation.
+
Use the same stringency in returning and checking your own variables. Use === and !== as necessary.
INCORRECT:
// If 'foo' is at the beginning of the string, strpos will return a 0,
@@ -329,7 +329,7 @@ if (strpos($str, 'foo') === FALSE)
INCORRECT:
function build_string($str = "")
{
- if ($str == "") // uh-oh! What if FALSE or the integer 0 is passed as an argument?
+ if ($str == "") // uh-oh! What if FALSE or the integer 0 is passed as an argument?
{
}
@@ -344,7 +344,7 @@ function build_string($str = "")
}
}
- See also information regarding typecasting, which can be quite useful. Typecasting has a slightly different effect which may be desirable. When casting a variable as a string, for instance, NULL and boolean FALSE variables become empty strings, 0 (and other numbers) become strings of digits, and boolean TRUE becomes "1":
+ See also information regarding typecasting, which can be quite useful. Typecasting has a slightly different effect which may be desirable. When casting a variable as a string, for instance, NULL and boolean FALSE variables become empty strings, 0 (and other numbers) become strings of digits, and boolean TRUE becomes "1":
$str = (string) $str; // cast $str as a string
@@ -362,7 +362,7 @@ function build_string($str = "")
Whitespace in Files
-
No whitespace can precede the opening PHP tag or follow the closing PHP tag. Output is buffered, so whitespace in your files can cause output to begin before CodeIgniter outputs its content, leading to errors and an inability for CodeIgniter to send proper headers. In the examples below, select the text with your mouse to reveal the incorrect whitespace.
+
No whitespace can precede the opening PHP tag or follow the closing PHP tag. Output is buffered, so whitespace in your files can cause output to begin before CodeIgniter outputs its content, leading to errors and an inability for CodeIgniter to send proper headers. In the examples below, select the text with your mouse to reveal the incorrect whitespace.
INCORRECT:
@@ -381,14 +381,14 @@ function build_string($str = "")
Compatibility
-
Unless specifically mentioned in your add-on's documentation, all code must be compatible with PHP version 5.1+. Additionally, do not use PHP functions that require non-default libraries to be installed unless your code contains an alternative method when the function is not available, or you implicitly document that your add-on requires said PHP libraries.
+
Unless specifically mentioned in your add-on's documentation, all code must be compatible with PHP version 5.1+. Additionally, do not use PHP functions that require non-default libraries to be installed unless your code contains an alternative method when the function is not available, or you implicitly document that your add-on requires said PHP libraries.
Class and File Names using Common Words
-
When your class or filename is a common word, or might quite likely be identically named in another PHP script, provide a unique prefix to help prevent collision. Always realize that your end users may be running other add-ons or third party PHP scripts. Choose a prefix that is unique to your identity as a developer or company.
+
When your class or filename is a common word, or might quite likely be identically named in another PHP script, provide a unique prefix to help prevent collision. Always realize that your end users may be running other add-ons or third party PHP scripts. Choose a prefix that is unique to your identity as a developer or company.
INCORRECT:
class Email pi.email.php
@@ -405,7 +405,7 @@ class Pre_import mod.pre_import.php
Database Table Names
-
Any tables that your add-on might use must use the 'exp_' prefix, followed by a prefix uniquely identifying you as the developer or company, and then a short descriptive table name. You do not need to be concerned about the database prefix being used on the user's installation, as CodeIgniter's database class will automatically convert 'exp_' to what is actually being used.
+
Any tables that your add-on might use must use the 'exp_' prefix, followed by a prefix uniquely identifying you as the developer or company, and then a short descriptive table name. You do not need to be concerned about the database prefix being used on the user's installation, as CodeIgniter's database class will automatically convert 'exp_' to what is actually being used.
INCORRECT:
email_addresses // missing both prefixes
@@ -416,35 +416,35 @@ exp_email_addresses // missing unique prefix
exp_pre_email_addresses
-
NOTE: Be mindful that MySQL has a limit of 64 characters for table names. This should not be an issue as table names that would exceed this would likely have unreasonable names. For instance, the following table name exceeds this limitation by one character. Silly, no? exp_pre_email_addresses_of_registered_users_in_seattle_washington
+
NOTE: Be mindful that MySQL has a limit of 64 characters for table names. This should not be an issue as table names that would exceed this would likely have unreasonable names. For instance, the following table name exceeds this limitation by one character. Silly, no? exp_pre_email_addresses_of_registered_users_in_seattle_washington
One File per Class
-
Use separate files for each class your add-on uses, unless the classes are closely related. An example of CodeIgniter files that contains multiple classes is the Database class file, which contains both the DB class and the DB_Cache class, and the Magpie plugin, which contains both the Magpie and Snoopy classes.
+
Use separate files for each class your add-on uses, unless the classes are closely related. An example of CodeIgniter files that contains multiple classes is the Database class file, which contains both the DB class and the DB_Cache class, and the Magpie plugin, which contains both the Magpie and Snoopy classes.
Whitespace
-
Use tabs for whitespace in your code, not spaces. This may seem like a small thing, but using tabs instead of whitespace allows the developer looking at your code to have indentation at levels that they prefer and customize in whatever application they use. And as a side benefit, it results in (slightly) more compact files, storing one tab character versus, say, four space characters.
+
Use tabs for whitespace in your code, not spaces. This may seem like a small thing, but using tabs instead of whitespace allows the developer looking at your code to have indentation at levels that they prefer and customize in whatever application they use. And as a side benefit, it results in (slightly) more compact files, storing one tab character versus, say, four space characters.
Line Breaks
-
Files must be saved with Unix line breaks. This is more of an issue for developers who work in Windows, but in any case ensure that your text editor is setup to save files with Unix line breaks.
+
Files must be saved with Unix line breaks. This is more of an issue for developers who work in Windows, but in any case ensure that your text editor is setup to save files with Unix line breaks.
Code Indenting
-
Use Allman style indenting. With the exception of Class declarations, braces are always placed on a line by themselves, and indented at the same level as the control statement that "owns" them.
+
Use Allman style indenting. With the exception of Class declarations, braces are always placed on a line by themselves, and indented at the same level as the control statement that "owns" them.
INCORRECT:
function foo($bar) {
@@ -501,7 +501,7 @@ for ($i = 0; $i < 10; $i++)
Bracket and Parenthetic Spacing
-
In general, parenthesis and brackets should not use any additional spaces. The exception is that a space should always follow PHP control structures that accept arguments with parenthesis (declare, do-while, elseif, for, foreach, if, switch, while), to help distinguish them from functions and increase readability.
+
In general, parenthesis and brackets should not use any additional spaces. The exception is that a space should always follow PHP control structures that accept arguments with parenthesis (declare, do-while, elseif, for, foreach, if, switch, while), to help distinguish them from functions and increase readability.
INCORRECT:
$arr[ $foo ] = 'foo';
@@ -558,9 +558,9 @@ _convert_text() // private method
PHP Errors
-
Code must run error free and not rely on warnings and notices to be hidden to meet this requirement. For instance, never access a variable that you did not set yourself (such as $_POST array keys) without first checking to see that it isset().
+
Code must run error free and not rely on warnings and notices to be hidden to meet this requirement. For instance, never access a variable that you did not set yourself (such as $_POST array keys) without first checking to see that it isset().
-
Make sure that while developing your add-on, error reporting is enabled for ALL users, and that display_errors is enabled in the PHP environment. You can check this setting with:
+
Make sure that while developing your add-on, error reporting is enabled for ALL users, and that display_errors is enabled in the PHP environment. You can check this setting with:
if (ini_get('display_errors') == 1)
{
@@ -571,7 +571,7 @@ _convert_text() // private method
ini_set('display_errors', 1);
-
NOTE: Setting the display_errors setting with ini_set() at runtime is not identical to having it enabled in the PHP environment. Namely, it will not have any effect if the script has fatal errors
+
NOTE: Setting the display_errors setting with ini_set() at runtime is not identical to having it enabled in the PHP environment. Namely, it will not have any effect if the script has fatal errors
@@ -609,7 +609,7 @@ $bat = str_replace($foo, $bar, $bag);
Strings
-
Always use single quoted strings unless you need variables parsed, and in cases where you do need variables parsed, use braces to prevent greedy token parsing. You may also use double-quoted strings if the string contains single quotes, so you do not have to use escape characters.
+
Always use single quoted strings unless you need variables parsed, and in cases where you do need variables parsed, use braces to prevent greedy token parsing. You may also use double-quoted strings if the string contains single quotes, so you do not have to use escape characters.
INCORRECT:
"My String" // no variable parsing, so no use for double quotes
diff --git a/user_guide/general/urls.html b/user_guide/general/urls.html
index 421f51301..b975b701f 100644
--- a/user_guide/general/urls.html
+++ b/user_guide/general/urls.html
@@ -58,7 +58,7 @@ URLS
CodeIgniter URLs
-By default, URLs in CodeIgniter are designed to be search-engine and human friendly. Rather than using the standard "query string"
+
By default, URLs in CodeIgniter are designed to be search-engine and human friendly. Rather than using the standard "query string"
approach to URLs that is synonymous with dynamic systems, CodeIgniter uses a segment-based approach:
example.com/news/article/my_article
@@ -78,7 +78,7 @@ approach to URLs that is synonymous with dynamic systems, CodeIgniter uses a
The URI Class and the URL Helper
-contain functions that make it easy to work with your URI data. In addition, your URLs can be remapped using the
+contain functions that make it easy to work with your URI data. In addition, your URLs can be remapped using the
URI Routing feature for more flexibility.
@@ -103,7 +103,7 @@ a request for your index.php file.
Adding a URL Suffix
In your config/config.php file you can specify a suffix that will be added to all URLs generated
-by CodeIgniter. For example, if a URL is this:
+by CodeIgniter. For example, if a URL is this:
example.com/index.php/products/view/shoes
@@ -125,7 +125,7 @@ open your config file you'll see these items:
$config['controller_trigger'] = 'c';
$config['function_trigger'] = 'm';
-
If you change "enable_query_strings" to TRUE this feature will become active. Your controllers and functions will then
+
If you change "enable_query_strings" to TRUE this feature will become active. Your controllers and functions will then
be accessible using the "trigger" words you've set to invoke your controllers and methods:
index.php?c=controller&m=method
diff --git a/user_guide/general/views.html b/user_guide/general/views.html
index ad93f4bc7..ece746592 100644
--- a/user_guide/general/views.html
+++ b/user_guide/general/views.html
@@ -61,7 +61,7 @@ Views
In fact, views can flexibly be embedded within other views (within other views, etc., etc.) if you need this type
of hierarchy.
-
Views are never called directly, they must be loaded by a controller. Remember that in an MVC framework, the Controller acts as the
+
Views are never called directly, they must be loaded by a controller. Remember that in an MVC framework, the Controller acts as the
traffic cop, so it is responsible for fetching a particular view. If you have not read the Controllers page
you should do so before continuing.
@@ -90,7 +90,7 @@ you should do so before continuing.
$this->load->view('name');
-
Where name is the name of your view file. Note: The .php file extension does not need to be specified unless you use something other than .php.
+
Where name is the name of your view file. Note: The .php file extension does not need to be specified unless you use something other than .php.
Now, open the controller file you made earlier called blog.php, and replace the echo statement with the view loading function:
@@ -109,19 +109,19 @@ class Blog extends CI_Controller {
-
If you visit your site using the URL you did earlier you should see your new view. The URL was similar to this:
+
If you visit your site using the URL you did earlier you should see your new view. The URL was similar to this:
example.com/index.php/blog/
Loading multiple views
-
CodeIgniter will intelligently handle multiple calls to $this->load->view from within a controller. If more than one call happens they will be appended together. For example, you may wish to have a header view, a menu view, a content view, and a footer view. That might look something like this:
+
CodeIgniter will intelligently handle multiple calls to $this->load->view from within a controller. If more than one call happens they will be appended together. For example, you may wish to have a header view, a menu view, a content view, and a footer view. That might look something like this:
<?php
class Page extends CI_Controller {
function index()
{
- $data['page_title'] = 'Your title';
+ $data['page_title'] = 'Your title';
$this->load->view('header');
$this->load->view('menu');
$this->load->view('content', $data);
@@ -132,8 +132,8 @@ class Page extends CI_Controller {
?>
In the example above, we are using "dynamically added data", which you will see below.
Storing Views within Sub-folders
-
Your view files can also be stored within sub-folders if you prefer that type of organization. When doing so you will need
-to include the folder name loading the view. Example:
+
Your view files can also be stored within sub-folders if you prefer that type of organization. When doing so you will need
+to include the folder name loading the view. Example:
$this->load->view('folder_name/file_name');
@@ -159,7 +159,7 @@ $this->load->view('blogview',
$data);
Note: If you use an object, the class variables will be turned into array elements.
-
Let's try it with your controller file. Open it add this code:
+
Let's try it with your controller file. Open it add this code:
-
Note: You'll notice that in the example above we are using PHP's alternative syntax. If you
+
Note: You'll notice that in the example above we are using PHP's alternative syntax. If you
are not familiar with it you can read about it here.
Returning views as data
There is a third optional parameter lets you change the behavior of the function so that it returns data as a string
-rather than sending it to your browser. This can be useful if you want to process the data in some way. If you
-set the parameter to true (boolean) it will return data. The default behavior is false, which sends it
-to your browser. Remember to assign it to a variable if you want the data returned:
+rather than sending it to your browser. This can be useful if you want to process the data in some way. If you
+set the parameter to
true (boolean) it will return data. The default behavior is
false, which sends it
+to your browser. Remember to assign it to a variable if you want the data returned:
$string = $this->load->view('myfile', '', true);
--
cgit v1.2.3-24-g4f1b
From 25d495b4a2598f771a858108a2cd2e96f0130412 Mon Sep 17 00:00:00 2001
From: Eric Barnes
Date: Tue, 26 Apr 2011 23:02:44 -0400
Subject: Removed the GET, POST, and COOKIE Data from security since we now
allow $_GET data. Fixes #48
---
user_guide/general/security.html | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
(limited to 'user_guide/general')
diff --git a/user_guide/general/security.html b/user_guide/general/security.html
index bcbb36c6f..31dd7978c 100644
--- a/user_guide/general/security.html
+++ b/user_guide/general/security.html
@@ -76,15 +76,9 @@ minimize the possibility that malicious data can be passed to your application.
Dash: -
-GET, POST, and COOKIE Data
-
-GET data is simply disallowed by CodeIgniter since the system utilizes URI segments rather than traditional URL query strings (unless
-you have the query string option enabled in your config file). The global GET
-array is unset by the Input class during system initialization.
-
Register_globals
-During system initialization all global variables are unset, except those found in the $_POST and $_COOKIE arrays. The unsetting
+
During system initialization all global variables are unset, except those found in the $_GET, $_POST, and $_COOKIE arrays. The unsetting
routine is effectively the same as register_globals = off.
--
cgit v1.2.3-24-g4f1b