664 lines
44 KiB
HTML
664 lines
44 KiB
HTML
|
|
||
|
|
|
||
|
|
<!DOCTYPE html>
|
||
|
|
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
|
||
|
|
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
|
||
|
|
<head>
|
||
|
|
<meta charset="utf-8">
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
|
|
|
||
|
|
<title>Security — CodeIgniter 3.1.5 documentation</title>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<link rel="shortcut icon" href="../_static/ci-icon.ico"/>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<link href='https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic|Roboto+Slab:400,700|Inconsolata:400,700&subset=latin,cyrillic' rel='stylesheet' type='text/css'>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<link rel="stylesheet" href="../_static/css/citheme.css" type="text/css" />
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<link rel="top" title="CodeIgniter 3.1.5 documentation" href="../index.html"/>
|
||
|
|
<link rel="up" title="General Topics" href="index.html"/>
|
||
|
|
<link rel="next" title="PHP Style Guide" href="styleguide.html"/>
|
||
|
|
<link rel="prev" title="Alternate PHP Syntax for View Files" href="alternative_php.html"/>
|
||
|
|
|
||
|
|
|
||
|
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/modernizr/2.6.2/modernizr.min.js"></script>
|
||
|
|
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body class="wy-body-for-nav" role="document">
|
||
|
|
|
||
|
|
<div id="nav">
|
||
|
|
<div id="nav_inner">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<div id="pulldown-menu" class="ciNav">
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="welcome.html">Welcome to CodeIgniter</a><ul class="simple">
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation Instructions</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/downloads.html">Downloading CodeIgniter</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/index.html">Installation Instructions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/upgrading.html">Upgrading From a Previous Version</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/troubleshooting.html">Troubleshooting</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../overview/index.html">CodeIgniter Overview</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/getting_started.html">Getting Started</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/at_a_glance.html">CodeIgniter at a Glance</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/features.html">Supported Features</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/appflow.html">Application Flow Chart</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/mvc.html">Model-View-Controller</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/goals.html">Architectural Goals</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../tutorial/index.html">Tutorial</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/static_pages.html">Static pages</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/news_section.html">News section</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/create_news_items.html">Create news items</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/conclusion.html">Conclusion</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../contributing/index.html">Contributing to CodeIgniter</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../documentation/index.html">Writing CodeIgniter Documentation</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../DCO.html">Developer’s Certificate of Origin 1.1</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul class="current">
|
||
|
|
<li class="toctree-l1 current"><a class="reference internal" href="index.html">General Topics</a><ul class="current">
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="urls.html">CodeIgniter URLs</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="controllers.html">Controllers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="reserved_names.html">Reserved Names</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="views.html">Views</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="models.html">Models</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="helpers.html">Helpers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="libraries.html">Using CodeIgniter Libraries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="creating_libraries.html">Creating Libraries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="drivers.html">Using CodeIgniter Drivers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="creating_drivers.html">Creating Drivers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="core_classes.html">Creating Core System Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="ancillary_classes.html">Creating Ancillary Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="hooks.html">Hooks - Extending the Framework Core</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="autoloader.html">Auto-loading Resources</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="common_functions.html">Common Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="compatibility_functions.html">Compatibility Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="routing.html">URI Routing</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="errors.html">Error Handling</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="caching.html">Caching</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="profiling.html">Profiling Your Application</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="cli.html">Running via the CLI</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="managing_apps.html">Managing your Applications</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="environments.html">Handling Multiple Environments</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="alternative_php.html">Alternate PHP Syntax for View Files</a></li>
|
||
|
|
<li class="toctree-l2 current"><a class="current reference internal" href="">Security</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="styleguide.html">PHP Style Guide</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../libraries/index.html">Libraries</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/benchmark.html">Benchmarking Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/caching.html">Caching Driver</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/calendar.html">Calendaring Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/cart.html">Shopping Cart Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/config.html">Config Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/email.html">Email Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/encrypt.html">Encrypt Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/encryption.html">Encryption Library</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/file_uploading.html">File Uploading Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/form_validation.html">Form Validation</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/ftp.html">FTP Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/image_lib.html">Image Manipulation Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/input.html">Input Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/javascript.html">Javascript Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/language.html">Language Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/loader.html">Loader Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/migration.html">Migrations Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/output.html">Output Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/pagination.html">Pagination Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/parser.html">Template Parser Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/security.html">Security Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/sessions.html">Session Library</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/table.html">HTML Table Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/trackback.html">Trackback Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/typography.html">Typography Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/unit_testing.html">Unit Testing Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/uri.html">URI Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/user_agent.html">User Agent Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/xmlrpc.html">XML-RPC and XML-RPC Server Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/zip.html">Zip Encoding Class</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../database/index.html">Database Reference</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/examples.html">Quick Start: Usage Examples</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/configuration.html">Database Configuration</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/connecting.html">Connecting to a Database</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/queries.html">Running Queries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/results.html">Generating Query Results</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/helpers.html">Query Helper Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/query_builder.html">Query Builder Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/transactions.html">Transactions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/metadata.html">Getting MetaData</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/call_function.html">Custom Function Calls</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/caching.html">Query Caching</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/forge.html">Database Manipulation with Database Forge</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/utilities.html">Database Utilities Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/db_driver_reference.html">Database Driver Reference</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../helpers/index.html">Helpers</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/array_helper.html">Array Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/captcha_helper.html">CAPTCHA Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/cookie_helper.html">Cookie Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/date_helper.html">Date Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/directory_helper.html">Directory Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/download_helper.html">Download Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/email_helper.html">Email Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/file_helper.html">File Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/form_helper.html">Form Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/html_helper.html">HTML Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/inflector_helper.html">Inflector Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/language_helper.html">Language Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/number_helper.html">Number Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/path_helper.html">Path Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/security_helper.html">Security Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/smiley_helper.html">Smiley Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/string_helper.html">String Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/text_helper.html">Text Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/typography_helper.html">Typography Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/url_helper.html">URL Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/xml_helper.html">XML Helper</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div id="nav2">
|
||
|
|
<a href="#" id="openToc">
|
||
|
|
<img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAZABkAAD/7AARRHVja3kAAQAEAAAARgAA/+4ADkFkb2JlAGTAAAAAAf/bAIQABAMDAwMDBAMDBAYEAwQGBwUEBAUHCAYGBwYGCAoICQkJCQgKCgwMDAwMCgwMDQ0MDBERERERFBQUFBQUFBQUFAEEBQUIBwgPCgoPFA4ODhQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU/8AAEQgAKwCaAwERAAIRAQMRAf/EAHsAAQAABwEBAAAAAAAAAAAAAAABAwQFBgcIAgkBAQAAAAAAAAAAAAAAAAAAAAAQAAEDAwICBwYEAgsAAAAAAAIBAwQAEQUSBiEHkROTVNQWGDFBUVIUCHEiMtOUFWGBobHRQlMkZIRVEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIRAxEAPwDSC+ygkOOaUoKigUCgUCgUCgUCgUCgUCgUCgkuGguIP9FBMFb0Hqg7We+3jlmIqqYFf4ub+/QYlnOR/LqIBKGFUbf8qWv971BytQXXE7Y3Lnm3HsFhp2TaZJAdchRXpIgSpdEJWxJEW3xoKV7F5OMy7JkQn2o7D6w33XGjEAkoiqrJEqIiOIiKuhePCgqp22dyYyS3CyWHnQ5joG61HkRnmnTbaFSMhExRVQRRVJU9iUHjE7ez+fJ0MFipmUNhBV8YUd2SoIV9KkjQla9ltegttBdPLW4/qocL+UTfrMiHW4+P9M71shuyrqaHTcxsl7jegpsji8nh5ZwMvDfgTm0RTjSmjYdFCS6KoOIipdFunCgmNYTMv457MMY6U7iI6oMieDDhRm1VbIhuoOkbqtuK0Hpzb+eZcYZexUxt6UyUqK2cd0SdjtgrhOgijcgERUlJOCIl6CpgbP3blRI8XgMjNARAyKNDfeRBdFDBVUAXgQrqH4pxoJTu2NysY97LP4ac1io5q1InHFeGO24LnVKJuKOkSQ/yKir+rh7aCLG1dzypZQI2FnvTgccYOM3FeN0XWERXAUEFVQgQkUktdLpegm+Td3/Xli/L+S/mYNJIOF9G/wBeLKrZHFb0akG6W1WtQWSg3Dyg5e7V3fipE3O4/wCrktyzYA+ufas2LbZIlmnAT2kvuoN1wft95augilglX/tzP3qCu9O3LL/wV/i5v79BvmTADq14UGu91467Z6U9y0HzH/ncj/U/sT/CgynZG7I2NezpZGUjIycJkYkZSG+uQ81pbBNKLxJfjwoMqZ3/ALYHl35AJ7/cuwHcu5k7r1Q5pHetBjquqVVJWGxj9Zrtcl/Ggy3dHMvauR3HFZj5nHNxSyW5JISYDMoIwx8tFIGHZhPNaykGapr6rUAiicEoMG21lMRj8buPAz8xhJrr7uOeiPTCyAwXUaGR1mgozbTusOsFLEiJ7fbQa/h7gcjy2H3V6xppwDNtUSxCJIqp7valBuWVzJ22xuCROXNNZiJkMtms0DbjUkAZjzoDrTMd9dDRI44ZC2YsrYdKWP2WDT2S3N9dNdlRYrGMYc06IURXSYb0igrpWS485xVNS6nF4rwslkoMwnbpgZLB7bmt5uMweAhDEl4B5uSLzzqTnnyVpW2jaJHRMSIjdDiiotvy3DOE5rYTEbkl5yFn28k7JyG4c7AU2HtLH1uKfaiMPI40CdYbpNtmLdwTSn5rewLNld+7TLdeal4WarWBkbVKBjgdElMJJwAAY5fl4kB3b1fp4XvagsGS3FjJfLzDNtS8aeXx7LzT7TyzByQE5PccRGRC0ZRUDRV6y62vbjagzLmJzS2vuPK43JY6aP1TW6Jz+RIWyFtyC06y3EkiiinAo7YCqfq1AqqnGgsOH3lhZO8d1pmcpB8j5XIm9OYlBJSQ/FSS4427DKO0RC8AlcEMhFdViRR1WDWR5t3WXVuL1d106kG9vdeye2g60+1FDyW0shIcXVpyroXt8I8dfd+NB1vioAdWnD3UF1+gD4UFc6CEKpagxXN43rwJLUHz7yX2c8zokt9uHlsPIhA4aRnnHJTLptIS6CNsY7iASpxUUMkReGpfbQW0vtN5pitvrsN28rwtBD0nc0+/Yft5XhaB6TuaXfsP28rwtA9J3NPv2H7eV4Wgek7mn37D9vK8LQPSdzT79h+3leFoHpO5pd+w/byvC0D0nc0u/Yft5XhaB6TuaXfsP28rwtA9J3NLv2H7eV4Wgek7ml37D9vK8LQPSdzS79h+3leFoHpO5p9+w/byvC0E9r7Reazy2HIYVPxkS/CUHVn26cosxyv2g7h89LYmZSXOenvLEQ1YaQ222RATcQCP8rSGqqA8S02W2pQ6FhMoAIlqCtsnwoCpdKClejI4i3Sgtb+GBxVuNBSFt1pV/RQefLjPyUDy4z8lA8uM/JQPLjPyUDy4z8lA8uM/JQPLjPyUDy4z8lA8uM/JQPLjPyUDy4z8lA8utJ/koJ7WCbBU/LQXOPAFq1koK8B0pag90CggtBBf6qB0UDooHRQOigdFA6KB0UDooHRQOigdFA6KB0UDooI0EaBQf//Z" title="Toggle Table of Contents" alt="Toggle Table of Contents" />
|
||
|
|
</a>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div class="wy-grid-for-nav">
|
||
|
|
|
||
|
|
|
||
|
|
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
|
||
|
|
<div class="wy-side-nav-search">
|
||
|
|
|
||
|
|
<a href="../index.html" class="fa fa-home"> CodeIgniter</a>
|
||
|
|
|
||
|
|
|
||
|
|
<div role="search">
|
||
|
|
<form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
|
||
|
|
<input type="text" name="q" placeholder="Search docs" />
|
||
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
||
|
|
<input type="hidden" name="area" value="default" />
|
||
|
|
</form>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="welcome.html">Welcome to CodeIgniter</a><ul class="simple">
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation Instructions</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/downloads.html">Downloading CodeIgniter</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/index.html">Installation Instructions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/upgrading.html">Upgrading From a Previous Version</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../installation/troubleshooting.html">Troubleshooting</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../overview/index.html">CodeIgniter Overview</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/getting_started.html">Getting Started</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/at_a_glance.html">CodeIgniter at a Glance</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/features.html">Supported Features</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/appflow.html">Application Flow Chart</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/mvc.html">Model-View-Controller</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../overview/goals.html">Architectural Goals</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../tutorial/index.html">Tutorial</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/static_pages.html">Static pages</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/news_section.html">News section</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/create_news_items.html">Create news items</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../tutorial/conclusion.html">Conclusion</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../contributing/index.html">Contributing to CodeIgniter</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../documentation/index.html">Writing CodeIgniter Documentation</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../DCO.html">Developer’s Certificate of Origin 1.1</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul class="current">
|
||
|
|
<li class="toctree-l1 current"><a class="reference internal" href="index.html">General Topics</a><ul class="current">
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="urls.html">CodeIgniter URLs</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="controllers.html">Controllers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="reserved_names.html">Reserved Names</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="views.html">Views</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="models.html">Models</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="helpers.html">Helpers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="libraries.html">Using CodeIgniter Libraries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="creating_libraries.html">Creating Libraries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="drivers.html">Using CodeIgniter Drivers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="creating_drivers.html">Creating Drivers</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="core_classes.html">Creating Core System Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="ancillary_classes.html">Creating Ancillary Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="hooks.html">Hooks - Extending the Framework Core</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="autoloader.html">Auto-loading Resources</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="common_functions.html">Common Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="compatibility_functions.html">Compatibility Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="routing.html">URI Routing</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="errors.html">Error Handling</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="caching.html">Caching</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="profiling.html">Profiling Your Application</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="cli.html">Running via the CLI</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="managing_apps.html">Managing your Applications</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="environments.html">Handling Multiple Environments</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="alternative_php.html">Alternate PHP Syntax for View Files</a></li>
|
||
|
|
<li class="toctree-l2 current"><a class="current reference internal" href="">Security</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="styleguide.html">PHP Style Guide</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../libraries/index.html">Libraries</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/benchmark.html">Benchmarking Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/caching.html">Caching Driver</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/calendar.html">Calendaring Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/cart.html">Shopping Cart Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/config.html">Config Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/email.html">Email Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/encrypt.html">Encrypt Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/encryption.html">Encryption Library</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/file_uploading.html">File Uploading Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/form_validation.html">Form Validation</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/ftp.html">FTP Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/image_lib.html">Image Manipulation Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/input.html">Input Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/javascript.html">Javascript Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/language.html">Language Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/loader.html">Loader Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/migration.html">Migrations Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/output.html">Output Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/pagination.html">Pagination Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/parser.html">Template Parser Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/security.html">Security Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/sessions.html">Session Library</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/table.html">HTML Table Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/trackback.html">Trackback Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/typography.html">Typography Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/unit_testing.html">Unit Testing Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/uri.html">URI Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/user_agent.html">User Agent Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/xmlrpc.html">XML-RPC and XML-RPC Server Classes</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../libraries/zip.html">Zip Encoding Class</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../database/index.html">Database Reference</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/examples.html">Quick Start: Usage Examples</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/configuration.html">Database Configuration</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/connecting.html">Connecting to a Database</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/queries.html">Running Queries</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/results.html">Generating Query Results</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/helpers.html">Query Helper Functions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/query_builder.html">Query Builder Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/transactions.html">Transactions</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/metadata.html">Getting MetaData</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/call_function.html">Custom Function Calls</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/caching.html">Query Caching</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/forge.html">Database Manipulation with Database Forge</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/utilities.html">Database Utilities Class</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../database/db_driver_reference.html">Database Driver Reference</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<ul>
|
||
|
|
<li class="toctree-l1"><a class="reference internal" href="../helpers/index.html">Helpers</a><ul>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/array_helper.html">Array Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/captcha_helper.html">CAPTCHA Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/cookie_helper.html">Cookie Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/date_helper.html">Date Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/directory_helper.html">Directory Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/download_helper.html">Download Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/email_helper.html">Email Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/file_helper.html">File Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/form_helper.html">Form Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/html_helper.html">HTML Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/inflector_helper.html">Inflector Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/language_helper.html">Language Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/number_helper.html">Number Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/path_helper.html">Path Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/security_helper.html">Security Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/smiley_helper.html">Smiley Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/string_helper.html">String Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/text_helper.html">Text Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/typography_helper.html">Typography Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/url_helper.html">URL Helper</a></li>
|
||
|
|
<li class="toctree-l2"><a class="reference internal" href="../helpers/xml_helper.html">XML Helper</a></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</nav>
|
||
|
|
|
||
|
|
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
|
||
|
|
|
||
|
|
|
||
|
|
<nav class="wy-nav-top" role="navigation" aria-label="top navigation">
|
||
|
|
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
||
|
|
<a href="../index.html">CodeIgniter</a>
|
||
|
|
</nav>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<div class="wy-nav-content">
|
||
|
|
<div class="rst-content">
|
||
|
|
<div role="navigation" aria-label="breadcrumbs navigation">
|
||
|
|
<ul class="wy-breadcrumbs">
|
||
|
|
<li><a href="../index.html">Docs</a> »</li>
|
||
|
|
|
||
|
|
<li><a href="index.html">General Topics</a> »</li>
|
||
|
|
|
||
|
|
<li>Security</li>
|
||
|
|
<li class="wy-breadcrumbs-aside">
|
||
|
|
|
||
|
|
</li>
|
||
|
|
<div style="float:right;margin-left:5px;" id="closeMe">
|
||
|
|
<img title="Classic Layout" alt="classic layout" src="data:image/gif;base64,R0lGODlhFAAUAJEAAAAAADMzM////wAAACH5BAUUAAIALAAAAAAUABQAAAImlI+py+0PU5gRBRDM3DxbWoXis42X13USOLauUIqnlsaH/eY6UwAAOw==" />
|
||
|
|
</div>
|
||
|
|
</ul>
|
||
|
|
<hr/>
|
||
|
|
</div>
|
||
|
|
<div role="main" class="document">
|
||
|
|
|
||
|
|
<div class="section" id="security">
|
||
|
|
<h1>Security<a class="headerlink" href="#security" title="Permalink to this headline">¶</a></h1>
|
||
|
|
<p>This page describes some “best practices” regarding web security, and
|
||
|
|
details CodeIgniter’s internal security features.</p>
|
||
|
|
<div class="admonition note">
|
||
|
|
<p class="first admonition-title">Note</p>
|
||
|
|
<p class="last">If you came here looking for a security contact, please refer to
|
||
|
|
our <cite>Contribution Guide <../contributing/index></cite>.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="uri-security">
|
||
|
|
<h2>URI Security<a class="headerlink" href="#uri-security" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>CodeIgniter is fairly restrictive regarding which characters it allows
|
||
|
|
in your URI strings in order to help minimize the possibility that
|
||
|
|
malicious data can be passed to your application. URIs may only contain
|
||
|
|
the following:</p>
|
||
|
|
<ul class="simple">
|
||
|
|
<li>Alpha-numeric text (latin characters only)</li>
|
||
|
|
<li>Tilde: ~</li>
|
||
|
|
<li>Percent sign: %</li>
|
||
|
|
<li>Period: .</li>
|
||
|
|
<li>Colon: :</li>
|
||
|
|
<li>Underscore: _</li>
|
||
|
|
<li>Dash: -</li>
|
||
|
|
<li>Space</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="register-globals">
|
||
|
|
<h2>Register_globals<a class="headerlink" href="#register-globals" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>During system initialization all global variables that are found to exist
|
||
|
|
in the <tt class="docutils literal"><span class="pre">$_GET</span></tt>, <tt class="docutils literal"><span class="pre">$_POST</span></tt>, <tt class="docutils literal"><span class="pre">$_REQUEST</span></tt> and <tt class="docutils literal"><span class="pre">$_COOKIE</span></tt> are unset.</p>
|
||
|
|
<p>The unsetting routine is effectively the same as <em>register_globals = off</em>.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="display-errors">
|
||
|
|
<h2>display_errors<a class="headerlink" href="#display-errors" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>In production environments, it is typically desirable to “disable” PHP’s
|
||
|
|
error reporting by setting the internal <em>display_errors</em> flag to a value
|
||
|
|
of 0. This disables native PHP errors from being rendered as output,
|
||
|
|
which may potentially contain sensitive information.</p>
|
||
|
|
<p>Setting CodeIgniter’s <strong>ENVIRONMENT</strong> constant in index.php to a value of
|
||
|
|
<strong>‘production’</strong> will turn off these errors. In development mode, it is
|
||
|
|
recommended that a value of ‘development’ is used. More information
|
||
|
|
about differentiating between environments can be found on the
|
||
|
|
<a class="reference internal" href="environments.html"><em>Handling Environments</em></a> page.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="magic-quotes-runtime">
|
||
|
|
<h2>magic_quotes_runtime<a class="headerlink" href="#magic-quotes-runtime" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>The <em>magic_quotes_runtime</em> directive is turned off during system
|
||
|
|
initialization so that you don’t have to remove slashes when retrieving
|
||
|
|
data from your database.</p>
|
||
|
|
<div class="section" id="best-practices">
|
||
|
|
<h3>Best Practices<a class="headerlink" href="#best-practices" title="Permalink to this headline">¶</a></h3>
|
||
|
|
<p>Before accepting any data into your application, whether it be POST data
|
||
|
|
from a form submission, COOKIE data, URI data, XML-RPC data, or even
|
||
|
|
data from the SERVER array, you are encouraged to practice this three
|
||
|
|
step approach:</p>
|
||
|
|
<ol class="arabic simple">
|
||
|
|
<li>Validate the data to ensure it conforms to the correct type, length,
|
||
|
|
size, etc.</li>
|
||
|
|
<li>Filter the data as if it were tainted.</li>
|
||
|
|
<li>Escape the data before submitting it into your database or outputting
|
||
|
|
it to a browser.</li>
|
||
|
|
</ol>
|
||
|
|
<p>CodeIgniter provides the following functions and tips to assist you
|
||
|
|
in this process:</p>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="xss-filtering">
|
||
|
|
<h2>XSS Filtering<a class="headerlink" href="#xss-filtering" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>CodeIgniter comes with a Cross Site Scripting filter. This filter
|
||
|
|
looks for commonly used techniques to embed malicious JavaScript into
|
||
|
|
your data, or other types of code that attempt to hijack cookies or
|
||
|
|
do other malicious things. The XSS Filter is described
|
||
|
|
<a class="reference internal" href="../libraries/security.html"><em>here</em></a>.</p>
|
||
|
|
<div class="admonition note">
|
||
|
|
<p class="first admonition-title">Note</p>
|
||
|
|
<p class="last">XSS filtering should <em>only be performed on output</em>. Filtering
|
||
|
|
input data may modify the data in undesirable ways, including
|
||
|
|
stripping special characters from passwords, which reduces
|
||
|
|
security instead of improving it.</p>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="csrf-protection">
|
||
|
|
<h2>CSRF protection<a class="headerlink" href="#csrf-protection" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>CSRF stands for Cross-Site Request Forgery, which is the process of an
|
||
|
|
attacker tricking their victim into unknowingly submitting a request.</p>
|
||
|
|
<p>CodeIgniter provides CSRF protection out of the box, which will get
|
||
|
|
automatically triggered for every non-GET HTTP request, but also needs
|
||
|
|
you to create your submit forms in a certain way. This is explained in
|
||
|
|
the <a class="reference internal" href="../libraries/security.html"><em>Security Library</em></a> documentation.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="password-handling">
|
||
|
|
<h2>Password handling<a class="headerlink" href="#password-handling" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>It is <em>critical</em> that you handle passwords in your application properly.</p>
|
||
|
|
<p>Unfortunately, many developers don’t know how to do that, and the web is
|
||
|
|
full of outdated or otherwise wrongful advices, which doesn’t help.</p>
|
||
|
|
<p>We would like to give you a list of combined do’s and don’ts to help you
|
||
|
|
with that. Please read below.</p>
|
||
|
|
<ul>
|
||
|
|
<li><p class="first">DO NOT store passwords in plain-text format.</p>
|
||
|
|
<p>Always <strong>hash</strong> your passwords.</p>
|
||
|
|
</li>
|
||
|
|
<li><p class="first">DO NOT use Base64 or similar encoding for storing passwords.</p>
|
||
|
|
<p>This is as good as storing them in plain-text. Really. Do <strong>hashing</strong>,
|
||
|
|
not <em>encoding</em>.</p>
|
||
|
|
<p>Encoding, and encryption too, are two-way processes. Passwords are
|
||
|
|
secrets that must only be known to their owner, and thus must work
|
||
|
|
only in one direction. Hashing does that - there’s <em>no</em> un-hashing or
|
||
|
|
de-hashing, but there is decoding and decryption.</p>
|
||
|
|
</li>
|
||
|
|
<li><p class="first">DO NOT use weak or broken hashing algorithms like MD5 or SHA1.</p>
|
||
|
|
<p>These algorithms are old, proven to be flawed, and not designed for
|
||
|
|
password hashing in the first place.</p>
|
||
|
|
<p>Also, DON’T invent your own algorithms.</p>
|
||
|
|
<p>Only use strong password hashing algorithms like BCrypt, which is used
|
||
|
|
in PHP’s own <a class="reference external" href="http://php.net/password">Password Hashing</a> functions.</p>
|
||
|
|
<p>Please use them, even if you’re not running PHP 5.5+, CodeIgniter
|
||
|
|
provides them for you.</p>
|
||
|
|
</li>
|
||
|
|
<li><p class="first">DO NOT ever display or send a password in plain-text format!</p>
|
||
|
|
<p>Even to the password’s owner, if you need a “Forgotten password”
|
||
|
|
feature, just randomly generate a new, one-time (this is also important)
|
||
|
|
password and send that instead.</p>
|
||
|
|
</li>
|
||
|
|
<li><p class="first">DO NOT put unnecessary limits on your users’ passwords.</p>
|
||
|
|
<p>If you’re using a hashing algorithm other than BCrypt (which has a limit
|
||
|
|
of 72 characters), you should set a relatively high limit on password
|
||
|
|
lengths in order to mitigate DoS attacks - say, 1024 characters.</p>
|
||
|
|
<p>Other than that however, there’s no point in forcing a rule that a
|
||
|
|
password can only be up to a number of characters, or that it can’t
|
||
|
|
contain a certain set of special characters.</p>
|
||
|
|
<p>Not only does this <strong>reduce</strong> security instead of improving it, but
|
||
|
|
there’s literally no reason to do it. No technical limitations and
|
||
|
|
no (practical) storage constraints apply once you’ve hashed them, none!</p>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="validate-input-data">
|
||
|
|
<h2>Validate input data<a class="headerlink" href="#validate-input-data" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>CodeIgniter has a <a class="reference internal" href="../libraries/form_validation.html"><em>Form Validation Library</em></a> that assists you in
|
||
|
|
validating, filtering, and prepping your data.</p>
|
||
|
|
<p>Even if that doesn’t work for your use case however, be sure to always
|
||
|
|
validate and sanitize all input data. For example, if you expect a numeric
|
||
|
|
string for an input variable, you can check for that with <tt class="docutils literal"><span class="pre">is_numeric()</span></tt>
|
||
|
|
or <tt class="docutils literal"><span class="pre">ctype_digit()</span></tt>. Always try to narrow down your checks to a certain
|
||
|
|
pattern.</p>
|
||
|
|
<p>Have it in mind that this includes not only <tt class="docutils literal"><span class="pre">$_POST</span></tt> and <tt class="docutils literal"><span class="pre">$_GET</span></tt>
|
||
|
|
variables, but also cookies, the user-agent string and basically
|
||
|
|
<em>all data that is not created directly by your own code</em>.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="escape-all-data-before-database-insertion">
|
||
|
|
<h2>Escape all data before database insertion<a class="headerlink" href="#escape-all-data-before-database-insertion" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>Never insert information into your database without escaping it.
|
||
|
|
Please see the section that discusses <a class="reference internal" href="../database/queries.html"><em>database queries</em></a> for more information.</p>
|
||
|
|
</div>
|
||
|
|
<div class="section" id="hide-your-files">
|
||
|
|
<h2>Hide your files<a class="headerlink" href="#hide-your-files" title="Permalink to this headline">¶</a></h2>
|
||
|
|
<p>Another good security practice is to only leave your <em>index.php</em>
|
||
|
|
and “assets” (e.g. .js, css and image files) under your server’s
|
||
|
|
<em>webroot</em> directory (most commonly named “htdocs/”). These are
|
||
|
|
the only files that you would need to be accessible from the web.</p>
|
||
|
|
<p>Allowing your visitors to see anything else would potentially
|
||
|
|
allow them to access sensitive data, execute scripts, etc.</p>
|
||
|
|
<p>If you’re not allowed to do that, you can try using a .htaccess
|
||
|
|
file to restrict access to those resources.</p>
|
||
|
|
<p>CodeIgniter will have an index.html file in all of its
|
||
|
|
directories in an attempt to hide some of this data, but have
|
||
|
|
it in mind that this is not enough to prevent a serious
|
||
|
|
attacker.</p>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
<footer>
|
||
|
|
|
||
|
|
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||
|
|
|
||
|
|
<a href="styleguide.html" class="btn btn-neutral float-right" title="PHP Style Guide">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||
|
|
|
||
|
|
|
||
|
|
<a href="alternative_php.html" class="btn btn-neutral" title="Alternate PHP Syntax for View Files"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
<hr/>
|
||
|
|
|
||
|
|
<div role="contentinfo">
|
||
|
|
<p>
|
||
|
|
© Copyright 2014 - 2017, British Columbia Institute of Technology.
|
||
|
|
Last updated on Jun 19, 2017.
|
||
|
|
</p>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
||
|
|
|
||
|
|
</footer>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</section>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<script type="text/javascript">
|
||
|
|
var DOCUMENTATION_OPTIONS = {
|
||
|
|
URL_ROOT:'../',
|
||
|
|
VERSION:'3.1.5',
|
||
|
|
COLLAPSE_INDEX:false,
|
||
|
|
FILE_SUFFIX:'.html',
|
||
|
|
HAS_SOURCE: false
|
||
|
|
};
|
||
|
|
</script>
|
||
|
|
<script type="text/javascript" src="../_static/jquery.js"></script>
|
||
|
|
<script type="text/javascript" src="../_static/underscore.js"></script>
|
||
|
|
<script type="text/javascript" src="../_static/doctools.js"></script>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<script type="text/javascript" src="../_static/js/theme.js"></script>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<script type="text/javascript">
|
||
|
|
jQuery(function () {
|
||
|
|
SphinxRtdTheme.StickyNav.enable();
|
||
|
|
});
|
||
|
|
</script>
|
||
|
|
|
||
|
|
|
||
|
|
</body>
|
||
|
|
</html>
|