Search Knowledge Base Articles

Module Security

So, you created your module and works fine, but is it secure? You must ensure that your module is secure and is not vulnerable to any SQL Injections are directory traversing. You can find below best practices to ensure that your module will be secure. Feel free to apply your own best practices for your module security.

Gather user data from requests

When a user is filling forms, the data is sent e.q. via a POST request to the controller after  you gather this data and insert into the database.

To ensure that this data is escaped, you should gather the data with the built-in CodeIgniter framework input class.

// Get data from POST request

$data = $this->input->post();
$client_id = $this->input->post('client_id');

// Get data from GET request

$data = $this->input->get();
$client_id = $this->input->get('client_id');

Do Not Allow Direct Access the Module Files

For each .php file you created for your module, you must add the code below at the top of the file to prevent the file to be accessed directly.

defined('BASEPATH') or exit('No direct script access allowed');

Include empty index.html files

Always add  index.html file in each folder you will create in your module directory including your module root directory.

E.q. in modules/[your-module]/

E.q. in modules[your-module]/views

Did you find this article useful?

Related Articles

  • Introduction to modules

    The modules documentation is valid starting from version 1.2.3.2 Daedelix PSA version 1.2.3.0 comes ...

  • Module Basics

    The modules documentation is valid starting from version 2.3.2 Daedelix PSA modules use the Code...

  • Module File Headers

    Each module in Daedelix PSA consist of init file which contains the general module configuration an...

  • Create Menu Items

    If you are creating your custom modules, probably you will want to create menu items that will be s...

  • Common Module Functions

    register_activation_hook /** * Register module activation hook * @param string $module module s...