Developing CI Based Forum - WIP

[eluser]Aken[/eluser]
It was an example -- I have no idea how your routes or other logic is set up to prevent messing with the URI, but that's my point. Never trust anything that the user can manipulate, and that includes the URI segments (which, btw, I do not believe are covered by XSS clean in any way, if I remember correctly). Also, remember that just because it's protected from shenanigans doesn't mean that it's the proper format you need. If you're expecting a number, and I write "hispurdy", it'll pass XSS stuff all day long, but could throw errors for not being an integer as expected. That's what you want to prevent with data checks / sanitization.

A major benefit of verifying the structure of your URI segment is that, if it is incorrect, you can throw an error without needing to run a query at all. That's obviously way better for performance.

Once it's in the proper format (letters, numbers, dashes, whatever you're allowing), then you can run your query. However, I think it's a good idea to run a single query first, that pulls your basic info for that particular section (its details, permissions, etc.). You don't need to tie that in with another huge query for the threads and posts info, and again, if anything goes wrong, you won't need to run that query anyway (this is tied with #1).