[eluser]leighmarble[/eluser]
[quote author="boltsabre" date="1394204389"]The only time I guess you wouldn't use input is when you want to ensure you have a legitimate session. You mentioned that going via the session way checks that the ip addresses match, and if they don't the session is being killed.
So yeah, if you are doing something where ensuring you have a legitimate session running is important then use session, else use input.[/quote]
Yes, that's true that the Session class will destroy a session if the new ip address doesn't match the old one (that is, as long as you have the config variable
sess_match_ip = TRUE). Although, in that case, it wouldn't actually make sense to pull the ip_address from the session to check it yourself, because what would you check it against? It would already be a new session (because the Session class would have killed the old one), so the ip address that you would get from the Session class and the Input class would once again match.
So, if you're talking about verifying a legitimate session, like maintaining a user's logged-in status or something like that, you'd want to check against a custom bit of userdata that would get set on login, using
Code:
$this->session->set_userdata('user_logged_in', 'TRUE');
And if the ip address changed during the lifetime of the session, that session would get destroyed, so the custom userdata would be lost at that point, automatically logging out the user.
