[eluser]D_Williams[/eluser]
I'm developing a custom reporting system for work using CI. After much tinkering I believe I've finally come up with a good implementation that should be secure, powerful, and extensible.
Before I explain my problem, let me try to sum up how it works without just dumping a bunch of code all over the place.
I have one main "reporting" controller. It has an index function that loads in the main report interface view. This view starts out simply displaying a bunch of links for every report in the system. The controller also has two AJAX only functions, called get_config() and run_report(). Somewhat obviously, get_config() loads in a view containing the report configuration form (asking for date ranges, client names, or whatever other data the report needs). run_report() is a fairly simple function, it determines what report is being requested and how the user wants it (display in page, download as PDF, or save to database are my current options). The report logic is stored in private methods of the reporting controller. One method for each report. run_report() calls the appropriate report method and does whatever is requested with the output.
Now, this isn't all implemented yet. Currently I have the get_config() part pretty much done and it works well. When a user clicks a report on the report list, it makes an AJAX call to get_config() which loads the appropriate view and returns the form inputs through AJAX, and they are displayed correctly. When the user fills out the report configuration and hits submit, it is correctly submitted via AJAX to run_report().
The obvious first step in run_report() is to validate and sanitize that form input. I'm a bit at a loss on how to do that, though. My first problem here is that every report has dynamic configuration options, so in run_report() I don't see any way to even determine what checks should be made. The second is that the CI form validation class doesn't seem to work here. It works great for "normal" form posts, but everything here is being posted behind the scenes in AJAX. I googled a bit and found some AJAX form validation classes, but if I'm understanding them correctly, they are all javascript client-side checks. I don't want to do that, I want to check it with PHP for obvious reasons. I also want a generalized and flexible solution here so that I don't have to write a bunch of form validation rules for every single report.
One note, if it's relevant here, is that I have a custom library that standardizes all report config fields. For example, here's one of my report config views:
Code:
<input type="hidden" name="report" value="account_acknowledgement" />
<b>Start Date:</b> <?php echo $this->form_elements->CalendarSelect('startdate'); ?><br />
<b>End Date:</b> <?php echo $this->form_elements->CalendarSelect('enddate'); ?><br />
<b>Client:</b> <?php echo $this->form_elements->ClientSelect('client'); ?>
form_elements is my custom library, and it has a handful of functions that return HTML for my semi-complex controls so they're the same in every report. For example, ClientSelect() queries the database for all our clients and returns a drop-down box. Each one of them takes one argument: the input element's name.
I have a habit of designing myself into a hole. Have I done it again? Does anyone have any nice solutions or advice here?
