Question

On Codeigniter, if you create a member using a signup form and sending data to an insert method in your model member, how do you filter data?

I’m looking for the best MVC way to do that, because I don’t want to save the value of the checkbox “I agree with…”, neither the value of a security question or this kind of things.

In my controller, it’s possible to do (before sending to model method):

$posts = $this->input->post();
unset($posts['abcdef']);
...

But it’s also possible to do that in my model (before using insert method):

function insert($data){
unset($data['abcdef']);
...
}

So, how do you do to filter data?

Answer 1

Both ways you posted work – but they are a “black-list”.

You should instead use a “white-list” in your model. This means your model will only look for the information its wants, and discards the rest. This prevent people from inserting addition $_POST data into your forms that you were not expecting.

In the model I do something like

function insert($inputs)
{
    $white_list = array ('field1', 'field2', ... ,'field9');
    foreach ($inputs as $post_id => $input)
    {
        if ( ! in_array ($post_id, $white_list))
        {
            unset($inputs[$post_id]);
        }
     }
    // Now insert data here and sleep easy at night
 }