CodeIgniter Forums

I Reviewed the 6 Best PHP Web Frameworks on G2 for 2026

Posted by: php_rocs - 07-17-2026, 04:36 PM - Replies (1)

	A nice read: https://learn.g2.com/best-php-web-frameworks

spark function generate-schema already exist ?

Posted by: geirea - 07-16-2026, 08:15 AM - No Replies

I saw a need for generating a complete sqlite schema, a copy of the production schema of the MariaDB for the phpunit testing framework.
I didn't find any already existing solution for this.

I created a generate-schema function which generates an output in
php spark tests:generate-schema <sql-file> --output ../tests/_support/Database/Generated/JuryTestTables.php

Code:
<?php

        // --- ci_sessions ---

        $this->forge->addField([

            'id'        => ['type' => 'VARCHAR', 'constraint' => 128],

            'ip_address' => ['type' => 'VARCHAR', 'constraint' => 45],

            'timestamp'  => ['type' => 'DATETIME', 'default' => new \CodeIgniter\Database\RawSql('CURRENT_TIMESTAMP')],

            'data'      => ['type' => 'BLOB'],

        ]);

        // $this->forge->addKey('timestamp');

        $this->forge->createTable('ci_sessions', true);

        // --- gx_app_config_options ---

        $this->forge->addField([

            'key'        => ['type' => 'VARCHAR', 'constraint' => 255],

            'value'      => ['type' => 'TEXT'],

            'category_id' => ['type' => 'INT', 'default' => 1],

        ]);

        $this->forge->addPrimaryKey('key');

The code is included in the Migrations, - and loaded upon bootstrapping the phpunit.

Code:
    public function up(): void

    {

        $generatedFile = __DIR__ . '/../Generated/JuryTestTables.php';

Is this something I only see a need for?

Geir

Docs on autopilot:

Posted by: InsiteFX - 07-11-2026, 07:35 AM - No Replies

	Docs on autopilot: From zero to self-maintaining with Mintlify

A PRACTICAL GUIDE TO AI AGENTS

Posted by: InsiteFX - 07-09-2026, 11:05 AM - Replies (1)

	Snowflake, A PRACTICAL GUIDE TO AI AGENTS

PHP Is Better Than JavaScript, And I Don't Care If This Starts A Fight

Posted by: php_rocs - 07-08-2026, 08:38 PM - Replies (1)

	Interesting perspective (DEV.TO): https://dev.to/p4nd3m1c/php-is-better-th...fight-36d0

CodeIgniter 4.7.4 Released!

Posted by: paulbalandan - 07-07-2026, 02:40 AM - Replies (3)

CodeIgniter 4.7.4 Released!

CodeIgniter 4.7.4 is now available.

This patch release focuses on security fixes and stability improvements across HTTP handling, validation, database behavior, sessions, testing, and command tooling. We strongly recommend upgrading as soon as possible.

GitHub Release
Changelog
Version 4.7.4 Notes

Highlights & New Features

Security hardening in request security detection, query builder escaping, uploaded file handling, and upload validation rule behavior.
Safer defaults for file movement and stricter extension/content agreement for upload validation checks.
Targeted reliability fixes in core components used in day-to-day applications.

Notable Enhancements

Database: ``updateBatch()`` now correctly throws an exception when used after unsupported ``where()`` conditions.
HTTP: Safari version detection now uses the ``Version`` token.
Validation: ``required_without`` logic now handles array dot notation correctly and avoids undefined key warnings.
Session: Redis lock retry settings now respect configured retry limits and intervals.
Testing: ``MockInputOutput`` no longer disrupts existing stream filters in test runs.
Commands: ``make:model --return entity`` now preserves sub-namespaces for generated Entities.

Security and Quality

``IncomingRequest::isSecure()`` now trusts ``X-Forwarded-Proto`` and ``Front-End-Https`` only for requests from trusted proxies in ``Config\App::$proxyIPs``.
Query Builder ``deleteBatch()`` now escapes WHERE bind values properly, preventing SQL injection risk when combined with ``where()``.
``UploadedFile::move()`` now sanitizes client-provided filenames when no explicit target name is passed, blocking traversal patterns like ``../../public/shell.php``.
Validation rules ``is_image`` and ``mime_in`` now enforce stronger filename extension checks against detected content.

Security advisories:
GHSA-7wmf-pw8j-mc78
GHSA-c9w5-rwh3-7pm9
GHSA-hhmc-q9hp-r662
GHSA-mmj4-63m4-r6h5

Breaking Changes

There are no intentional framework-level breaking changes in 4.7.4.

Removed Deprecated Items

None in this release.

Other Notable Changes

``env()`` and ``esc()`` received fixes for safer type and encoding handling.
``InvalidChars`` now validates both array keys and values.
XML export now preserves ``0`` and ``'0'`` values.
``SodiumHandler`` error and parameter handling has been normalized for clearer exception behavior.

Thanks to Our Contributors

Many thanks to everyone who contributed fixes and improvements for this release:

@michalsn
@gr8man
@paulbalandan
@memleakd
@xgrind
@ThomasMeschke
@Will-thom

Upgrade Guide
Report Issues

If you run into issues while upgrading, please include your environment details and a small reproducible case when opening a report.

Note: This announcement was created with the assistance of GitHub Copilot (GPT-5.3-Codex).

AI Agent for CodeIgniter best practices and security awareness

Posted by: markpessoa - 07-06-2026, 04:34 AM - Replies (3)

Hi everyone,
Has anyone here created or experimented with an AI agent specialized in CodeIgniter development?

I’m thinking about an agent that understands CodeIgniter 4 best practices, secure coding, authentication, validation, database safety, project structure, testing, and code review.

The idea is to use it with tools like Cursor, Codex, Claude, or similar, to help build CodeIgniter applications with better consistency and security awareness.

I’d be interested to hear if anyone has tried this, what worked, what didn’t, and whether you have any prompts, agent structures, or guidelines to share.
Thanks.

prefix changing?

Posted by: Glabella - 07-05-2026, 10:04 PM - Replies (1)

Today I discovered something, that Ubuntu (and Debian) do their own PHP sessions garbage collection but that sessions not prefixed by 'sess_' are ignored. So the CI default session name of 'ci_session' never gets deleted, on my ubuntu box they can be found in /var/lib/php/sessions. The script /usr/lib/php/sessionclean which run every half hour does the cleaning and it was in there that I saw the prefix requirement.

Allowed memory size of 134217728 bytes exhausted

Posted by: vido - 07-03-2026, 07:39 AM - Replies (1)

Hi,
I'm experiencing "Allowed memory size of 134217728 bytes exhausted (tried to allocate 17074512 bytes)" in vendor/codeigniter4/framework/system/ThirdParty/Kint/Renderer/RichRenderer.php.
when running the CI (v4.7.1) application in a development environment (CI_ENVIRONMENT = development). There is no problem when running in production environment.
I changed

PHP Code:
defined('CI_DEBUG') || define('CI_DEBUG', true); 

in app/Config/Boot/development.php to:

PHP Code:
defined('CI_DEBUG') || define('CI_DEBUG', false); 

and the problem disappear.
Any ideas on how I can fix the problem without changing the default development configuration? I believe there is something that is causing an infinitive loop or an endless recursion.
Thank you.

Preventing "Array to string conversion" exception when logging an array

Posted by: vido - 07-02-2026, 06:15 PM - Replies (1)

I'm using CodeIgniter 4.7.3 and PHP 8.5
I'm experiencing "Array to string conversion" exception when a third party library (PaypalServerSdkLib) is trying to write a log message where one of the elements in $context array argument is an array (another array within $context array). More specifically, the error (warning to be precise) occurs in Logger.php at line 337:

PHP Code:
return strtr($message, $replace); 

That is causing a PHP E_WARNING. Since PHP 8.0 it is not E_DEPRECATED anymore. By default, CI4 is throwing exceptions for the PHP warnings and I don't want to change the default: error_reporting(E_ALL & ~E_DEPRECATED);
So to prevent the PHP warning and the CI exception I inserted the following line in Logger.php at line 307 to convert the array to string before adding it to $replace array used for the strtr call:

PHP Code:
if (is_array($val)) $val = print_r($val, true); 

There are already similar lines to convert GET and POST request parameters from arrays to strings (lines 311 and 312).
Usually I would change the code that is calling the logger but there are multiple log call so I think changing the CI4 Logger to accept arrays is better solution. According to PSR-3 logger interface description, the $content argument is an array and "The array can contain anything.". Presumably, the $content array can contain other arrays so that change complies with the PSR-3 logger interface description.
Can that patch be included in the future CI versions? Will that cause any other problems?
Thank you.

Pages (7870): 1 2 3 4 5 … 7870 Next »

Welcome, Guest

You have to register before you can post on our site.

Latest Threads

How to convert the query ...
by Pood2003
07-19-2026, 08:16 PM

Remove /public from URLs
by nevisalexander
07-19-2026, 08:01 PM

I Reviewed the 6 Best PHP...
by InsiteFX
07-17-2026, 08:42 PM

spark function generate-s...
by geirea
07-16-2026, 08:15 AM

How to update with Compos...
by InsiteFX
07-14-2026, 09:14 PM

how to check if url exist...
by InsiteFX
07-12-2026, 09:36 PM

Docs on autopilot:
by InsiteFX
07-11-2026, 07:35 AM

A PRACTICAL GUIDE TO AI A...
by FlavioSuar
07-10-2026, 08:24 AM

AI Agent for CodeIgniter ...
by FlavioSuar
07-10-2026, 08:19 AM

PHP Is Better Than JavaSc...
by InsiteFX
07-08-2026, 11:51 PM

Forum Statistics

» Members: 222,613
» Latest member: fastjob
» Forum threads: 78,725
» Forum posts: 381,081

Full Statistics

Search Forums

(Advanced Search)