Controllers must have an index() function?

[eluser]Référencement Google[/eluser]
@Derek: Oops, yes I have missed that one! (2 years using CI and didn't see that...)

[eluser]Derek Allard[/eluser]
Hey man, I know exactly how you feel. I can top it. I wrote the DBForge library, and I still need to keep the manual page open in one tab as I use it

[eluser]wiredesignz[/eluser]
Modular Extensions uses _remap() perfectly. This allows the Module name to be extracted from the URI and the Module run as needed.

[eluser]Ryuuzaki92[/eluser]
@elitemedia: i use it to display my user's profile:

eg:
profile/user1
profile/user2
profile/user3...

profile controller using _remap($username) function to grab everything

i also did some advance routings like user photos etc etc

profile/user1/photos
profile/user1/photos

Code:

function _remap($username, $page = NULL)
{
  // validate username....
  $user = $this->user->get_by_username($username);
  
  if ($page === NULL) {
    $this->profile($user);
  } else {
    // do some validation here
    // $this->$page();
  }
}

[eluser]Référencement Google[/eluser]
@wiredesignz: Thanks for the tip, I have not yet used your awesome lib but I plan to use it in my next project so I will look at the _remap function.

@Ryuuzaki92: Thanks for the concrete example, now that let me imagine concretely what I can do with this.
Just a question: Does CI make it enough secure to do a DB query directly from the url like in your example?

[eluser]Ryuuzaki92[/eluser]
i used the get_where() function in the user model. everything is escaped automatically by CI:

Code:

// user model
function get_by_username($username)
{
  return $this->db->get_where('users', array('username' => $username))->row();
}

read more about it here: http://ellislab.com/codeigniter/user-gui...ecord.html

[eluser]Référencement Google[/eluser]

i used the get_where() function in the user model. everything is escaped automatically by CI:

I know this, my question was more about a "paranoid security level".
So, my question is: Does CI active record escaping prevent every possible risk? What kind of security check should we use, maybe check before if a record exists? Or I am too much paranoid and CI active record escaping is enough?

[eluser]Ryuuzaki92[/eluser]
from the user quide:

Note: All values are escaped automatically producing safer queries.

normally you would read the return data and show a 404 page if the record does not exist.

Code:

$user = $this->user->get_by_username($username);

if (!$user->id) {
  show_404();
}