Security

Security is a set of habits spread across the application, not a single switch. CodeIgniter supplies useful tools, but you still need to use them consistently.

Escape everything you display

echo esc($comment['body']);

Escaping converts characters such as < into entities so a stored value cannot become a script.

Protect state-changing requests

<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>">

Enable CSRF protection in the filter configuration and include the token in every form.

Prevent SQL injection

$db->table('users')->where('email', $email)->first();

Use the query builder or prepared statements. Never interpolate request values into a SQL string.

Hash passwords correctly

$hash = password_hash($password, PASSWORD_DEFAULT);

if (password_verify($password, $hash)) {
    // Credentials match.
}

Never invent a hashing scheme and never log passwords or hashes.

Validate uploads

Check MIME type and size, generate a new filename, and store private files outside the web root. Serve protected files through a controller that checks permission.

Additional checks

• Use HTTPS everywhere and set secure cookie flags.
• Apply an authentication filter to every protected route group.
• Authorise each action, not just each page; verify that the user owns the record.
• Keep dependencies updated and review security advisories.
• Limit login attempts and log suspicious activity.
• Set CI_ENVIRONMENT = production so stack traces never reach visitors.
• Do not expose .env, writable, or vendor through the web server.

For every form, ask where the data goes, how it is validated, how it is stored, and how it is escaped when shown again.