Question

E.g. I have a working url:

http://localhost/article/154

Where 154 is $id of the article in db and a controller article looks like e.g.:

function index ($id = '')
{

// some code here

}

Now, when I type something like:

http://localhost/article/154dsdead34

I get error because that id is not in my db. But, the php errors are shown on the page and the whole page is messedd up.

Instead I need a redirect to my controller called custom404 that can handle this (or if it is for some reason not possible at least a direct redirect(‘/’); to the homepage)

The same fix for variants like (to big $id number or not found in db):

http://localhost/article/3004534534534234600234

or (other parameters)

http://localhost/article/154/something/derer/asdasd

how to do such security check in CodeIgniter?

Answer 1

So many ways to do this.

Inside the function, define ($id = NULL) so it skips empty errors, and the 1st statement can be if ( ! is_numeric($id)) show_404();

You could also run $id = (int)$id; which should turn 154dsdead34 into 154.

Routing is an option aswell. What would you prefer?

You could do like this; inside the function run:

if ( ! preg_match("~^article/\d+$~", $this->uri->uri_string())) {
    // Redirect user
}

Change accordingly. ~ opens and closes the regex. it’s often /, but with like ~ you don’t have to escape / (\/). ^ is the beginning of the string and $ is the end. \d+ is equal to [0-9]+ and requires cases with one digit or more. I hope it makes sense.