jQuery form validation using CI back-end rules

[eluser]steelaz[/eluser]
I created solution that does front-end validation using back-end validation rules. No more writing separate validation routines and you get the same native CI validation error messages on front-end.

Blog post (how it works)

Source code

Demo

[eluser]steelaz[/eluser]
Updated the code to add CI "matches" rule - demo

[eluser]eggzy[/eluser]
Nice work man, looks good

[eluser]ipsod[/eluser]
Good idea.

[eluser]theshiftexchange[/eluser]
I just wanted to come back and /bump this thread - and say thanks again to Steelaz - this is an awesome addon - which has saved me so much time, and greatly improved the logic and cleanness of my website code.

Thanks!!

[eluser]CroNiX[/eluser]
I do the same thing except I created a new method in MY_Form_Validation to return the validation error ARRAY ($_error_array), so I can highlight the individual error fields when it gets returned to the ajax callback as a json object. (as opposed to just using validation_errors() which returns a single string with all errors)

[eluser]noname525[/eluser]
vv

[eluser]theshiftexchange[/eluser]
question: has anyone here been able to get this to work when CSRF is turned on? Mine stops working - and I'm not 100% sure how to fix it....

[eluser]theshiftexchange[/eluser]
I needed a quick fix for this - so I decided that a solution would be to "ignore" the CSRF check for the jquery validation calls.

There is no (obvious) security risk I can see here, because the validation rules are public knowledge anyway (since we send them as text to the browser).

To achieve this, I extended the Security class, and did a check for the "welcome/remote" URI. For me, this is my generic path that all my jquery validation goes to. Just change "welcome/remote" to wherever your remote() function is.

Code:

<?php
/**
* A fix to ignore CSRF tokens for the jquery_validation
*
*/

class MY_Security extends CI_Security
{
    public function __construct()
    {
        parent::__construct();

    }
  
public function csrf_verify()
{
  // Firstly - manually get our controller/method
  // We cant use the CI instance yet

  $uri = $_SERVER['REQUEST_URI'];
  if (strpos($uri, $_SERVER['SCRIPT_NAME']) === 0)
  {
   $uri = substr($uri, strlen($_SERVER['SCRIPT_NAME']));
  }
  elseif (strpos($uri, dirname($_SERVER['SCRIPT_NAME'])) === 0)
  {
   $uri = substr($uri, strlen(dirname($_SERVER['SCRIPT_NAME'])));
  }
  

  // Check if this is a jquery remote check
  $pos = strrpos ($uri, "welcome/remote");

  if ($pos === false)
  {
   // No? Then complete the csrf check as normal
   return parent::csrf_verify();

  }
  else
  {
   // Yes? Then just ignore it as if nothing happened
   return $this;
  }  
}
}

If anyone can see any flaws/security issues with this - I'd be keen to hear it...

[eluser]CroNiX[/eluser]
Just pass the CSRF token. Much better than disabling security.