CodeIgniter Forums

Full Version: Protecting successive screens of a wizard
You're currently viewing a stripped down version of our content. View the full version with proper formatting.

El Forum

[eluser]jules123[/eluser]
Hello, I have been using CI for a month or so, and have been loving it. This forum is great and I didn't have to post any question until now. Smile I am hoping that the experts on this forum can help me with my question below.

As part of our application, we have several wizards that lead the users through successive pages, that perform data entry, data validation, and storing. E.g. I have controller methods such as wizardA_1(), wizardA_2(), wizardA_3(), wizardA_done() to implement this.

I plan to implement post-controller hooks that will ensure that each method is called only if a valid session exists. But I also want to ensure that the next screen of the wizard is displayed only if a user submits the previous screen. Otherwise, I would like to display an error message. E.g. If a user views wizardA_1 and then directly changes the URL in the browser to invoke wizardA_3, it should display an error message.

Q1. What is the best way to do this from within CI?

Note that since the wizards have forms and I am using form validation class, method wizardA_1() calls view wizardA_1 in case validations fail, and calls view wizardA_2 if validations succeed. View wizardA_1 submits to itself etc.

if ($this->form_validation->run() == FALSE) {
$this->load->view('wizardA_1');
} else {
$this->load->view('wizardA_2');
}

Q2. Also, if I implement the error message above, from a security perspective, do I need to check explicitly in each method if it has received all the required parameters? Since I am ensuring that each view is displayed only after submitting previous view successfully (i.e. form validations have passed), the view will have all the required parameters...Any thoughts?

Thanks in advance for any help!!

El Forum

[eluser]GSV Sleeper Service[/eluser]
this is by no way the 'best way', but it's a technique I've used before.

you could set a session after each successful step ie
stage/1
display view
validation run?
yes
set session 'stage1_complete'
redirect to stage/2
no
redirect to stage/1

stage/2
is session 'stage1_complete' set?
no
redirect to stage/1
yes
display view 2
etc

El Forum

[eluser]jules123[/eluser]
Thanks so much GSV. That seems like would do the trick. Smile