What is the 'correct' way to gather $_POST input from my form via CodeIgniter/PHP?

Question

This is more of a theoretical question than a specific one.

I have a form set up with CodeIgniter's Form Validation class. I have some rules being run, for example:

$this->form_validation->set_rules('address_line_1', 'Address Line 1', 'required|xss_clean|trim');

I eventually want to put the address_line_1 data into my Database. This is where I'm a little confused. It seems there are several ways of fetching $_POST data from within CodeIgniter:

1. $address = $_POST['address_line_1'];

2. $address = $this->input->post('address_line_1');

3. $address = $this->form_validation->set_value('address_line_1');

4. $address = set_value('address_line_1);

So which way is the 'correct' way?

Whilst I'm sure several of these assumptions are wrong, I've been led to believe that...

• $_POST is unsanitised by CodeIgniter's security (I'm confident about this one)

• $this->input->post() will sanitise the data (to a certain extent), but won't have applied any Form Validation prepping rules

• $this->form_validation->set_value() is the same as set_value(), but...

• ... set_value() is intended to re-populate form inputs via their value="" element.

Which of my assumptions are correct and which are wrong? And what is the way I should be pulling through $_POST data when I'm prepping it with Form Validation? The Form Validation documentation is ambiguous when it comes to this. None of the examples ever show it actually passing input data onto a model, for example.

Thanks!

Jack

Answer 1

They are all different, or they wouldn't all exist.

1. $_POST['foo'] is unprotected and raw output. BAD. Don't touch. etc.
2. $this->input->post('foo') escaped and XSSified input. Defaults to FALSE instead of erroring.
3. $this->form_validation->set_value() this will take the validated output, which may have been modified through the validation rules. For example, if you add "trim" as a validation rule, the validated content will be trimmed.
4. set_value() just an alias of the method above. People don't like to use $this in their views.

This is all in the documentation.