CodeIgniter Forums - All Forums

Settings v2.4.0 Released

Thu, 30 Jul 2026 16:24:23 +0000

CodeIgniter Settings v2.4.0 Released

We are happy to announce the release of CodeIgniter Settings v2.4.0 for CodeIgniter 4.

This release introduces batch setting operations through the new getMany(), setMany(), and forgetMany() APIs. It also fixes issues with deferred database writes and setting value persistence on SQL Server.

See the release notes for details:
https://github.com/codeigniter4/settings...tag/v2.4.0

Full changelog:
https://github.com/codeigniter4/settings...0...v2.4.0

Documentation:
https://settings.codeigniter.com

CodeIgniter Settings provides persistent, strongly typed application settings for CodeIgniter 4, with support for multiple storage handlers and runtime overrides.

We would also like to welcome @memleakd, who made their first contribution to the project in this release.

CodeIgniter 4: Best Way to Organize Large Projects?

Thu, 30 Jul 2026 11:40:56 +0000

Hi everyone,
I'm currently building a medium-sized application using CodeIgniter 4, and as the project grows I'm trying to keep the codebase clean and maintainable.
I'd like to know what folder structure and architecture experienced CodeIgniter developers prefer for larger applications.
A few questions I have are:

Do you keep business logic only inside Models, or do you create a separate Services layer?
How do you organize reusable helper functions?
Is it recommended to use Repository or Service classes in CodeIgniter 4?
How do you structure controllers when there are many modules?
What practices have helped you keep projects maintainable over time?

I'm looking for suggestions based on real-world experience rather than just the documentation.
Thanks in advance!

Nextgen CI Datagrid with Ai, Master-detail, Export etc

Thu, 30 Jul 2026 01:25:05 +0000

Hi all,
Ii wanted to share a package gridphp/ci4-starter
CodeIgniter-4 application starter pre-configured with GridPHP low-code DataGrid designed for building lightning-fast CRUD, DB admin panels, CRMs & backoffice tools. It generates fully interactive, mobile-ready CRUDs from db tables of MySQL, PostgreSQL/Supabase, Oracle & SQLServer.

GitHub: https://github.com/gridphp/ci4-starter
Composer: http://packagist.org/packages/gridphp/ci4-starter

Performance Issue in a PHP Website

Wed, 29 Jul 2026 09:10:42 +0000

Hello

There is a PHP wesbite which serves 3 pages (home, login, meeting). home and meeting page is of images and login is a database transaction.
Tested the website for 1000 concurrent users (100tps). The database page login does well, the problem is with serving images (10+ second response times)
System: t3.medium aws server, ubuntu 20, apache mpmevent, php 7, mysql 5, jmeter.

Any ideas?

The Dirty Secret Behind AI Agents (Demo ?)

Fri, 24 Jul 2026 18:22:41 +0000

The Dirty Secret Behind AI Agents (Demo ?)

Queue v1.0.1 Released

Fri, 24 Jul 2026 07:36:52 +0000

CodeIgniter Queue v1.0.1 Released

We are happy to announce the release of CodeIgniter Queue v1.0.1 for CodeIgniter 4.

This patch release improves the reliability of database-backed queues by fixing SQLite3 queue pop atomicity and hardening queue priority ordering.

See the release notes for details:
https://github.com/codeigniter4/queue/re...tag/v1.0.1

Full changelog:
https://github.com/codeigniter4/queue/co...0...v1.0.1

Documentation:
https://queue.codeigniter.com

CodeIgniter Queue is a queue library for CodeIgniter 4 that helps run background jobs in a simple and production-friendly way.

Shield v1.4.0 Released

Thu, 23 Jul 2026 16:13:38 +0000

CodeIgniter Shield v1.4.0 Released

Key Improvements

Conditional Authentication Actions - Authentication actions can now be enabled conditionally, providing more control over when individual actions are available.
More Flexible Authentication Routes - A new only option allows applications to register only selected authentication routes.
Hierarchical Permission Wildcards - Permission checks now support wildcards across hierarchical permission names.

Bug Fixes

Magic links now correctly require the configured login actions.
Fixed an issue where refreshing a remember-me token could fail when using
loginView()
.

New Contributors

We would like to welcome the following first-time contributors:

@Dimtrovich
@memleakd
@tomatlscomm

See the release notes for details:
https://github.com/codeigniter4/shield/r...tag/v1.4.0

Full changelog:
https://github.com/codeigniter4/shield/c...0...v1.4.0

Shield is the official authentication and authorization framework for CodeIgniter 4.

See https://shield.codeigniter.com/

I Reviewed the 6 Best PHP Web Frameworks on G2 for 2026

Fri, 17 Jul 2026 23:36:09 +0000

A nice read: https://learn.g2.com/best-php-web-frameworks

spark function generate-schema already exist ?

Thu, 16 Jul 2026 15:15:25 +0000

I saw a need for generating a complete sqlite schema, a copy of the production schema of the MariaDB for the phpunit testing framework.
I didn't find any already existing solution for this.

I created a generate-schema function which generates an output in
php spark tests:generate-schema --output ../tests/_support/Database/Generated/JuryTestTables.php

Code:

        // --- ci_sessions ---

        $this->forge->addField([

            'id'        => ['type' => 'VARCHAR', 'constraint' => 128],

            'ip_address' => ['type' => 'VARCHAR', 'constraint' => 45],

            'timestamp'  => ['type' => 'DATETIME', 'default' => new \CodeIgniter\Database\RawSql('CURRENT_TIMESTAMP')],

            'data'      => ['type' => 'BLOB'],

        ]);

        // $this->forge->addKey('timestamp');

        $this->forge->createTable('ci_sessions', true);

        // --- gx_app_config_options ---

        $this->forge->addField([

            'key'        => ['type' => 'VARCHAR', 'constraint' => 255],

            'value'      => ['type' => 'TEXT'],

            'category_id' => ['type' => 'INT', 'default' => 1],

        ]);

        $this->forge->addPrimaryKey('key');

The code is included in the Migrations, - and loaded upon bootstrapping the phpunit.

Code:
    public function up(): void

    {

        $generatedFile = __DIR__ . '/../Generated/JuryTestTables.php';

Is this something I only see a need for?

Geir

Docs on autopilot:

Sat, 11 Jul 2026 14:35:42 +0000

Docs on autopilot: From zero to self-maintaining with Mintlify

A PRACTICAL GUIDE TO AI AGENTS

Thu, 09 Jul 2026 18:05:11 +0000

Snowflake, A PRACTICAL GUIDE TO AI AGENTS

PHP Is Better Than JavaScript, And I Don't Care If This Starts A Fight

Thu, 09 Jul 2026 03:38:50 +0000

Interesting perspective (DEV.TO): https://dev.to/p4nd3m1c/php-is-better-th...fight-36d0

CodeIgniter 4.7.4 Released!

Tue, 07 Jul 2026 09:40:14 +0000

CodeIgniter 4.7.4 Released!

CodeIgniter 4.7.4 is now available.

This patch release focuses on security fixes and stability improvements across HTTP handling, validation, database behavior, sessions, testing, and command tooling. We strongly recommend upgrading as soon as possible.

GitHub Release
Changelog
Version 4.7.4 Notes

Highlights & New Features

Security hardening in request security detection, query builder escaping, uploaded file handling, and upload validation rule behavior.
Safer defaults for file movement and stricter extension/content agreement for upload validation checks.
Targeted reliability fixes in core components used in day-to-day applications.

Notable Enhancements

Database: ``updateBatch()`` now correctly throws an exception when used after unsupported ``where()`` conditions.
HTTP: Safari version detection now uses the ``Version`` token.
Validation: ``required_without`` logic now handles array dot notation correctly and avoids undefined key warnings.
Session: Redis lock retry settings now respect configured retry limits and intervals.
Testing: ``MockInputOutput`` no longer disrupts existing stream filters in test runs.
Commands: ``make:model --return entity`` now preserves sub-namespaces for generated Entities.

Security and Quality

``IncomingRequest::isSecure()`` now trusts ``X-Forwarded-Proto`` and ``Front-End-Https`` only for requests from trusted proxies in ``Config\App::$proxyIPs``.
Query Builder ``deleteBatch()`` now escapes WHERE bind values properly, preventing SQL injection risk when combined with ``where()``.
``UploadedFile::move()`` now sanitizes client-provided filenames when no explicit target name is passed, blocking traversal patterns like ``../../public/shell.php``.
Validation rules ``is_image`` and ``mime_in`` now enforce stronger filename extension checks against detected content.

Security advisories:
GHSA-7wmf-pw8j-mc78
GHSA-c9w5-rwh3-7pm9
GHSA-hhmc-q9hp-r662
GHSA-mmj4-63m4-r6h5

Breaking Changes

There are no intentional framework-level breaking changes in 4.7.4.

Removed Deprecated Items

None in this release.

Other Notable Changes

``env()`` and ``esc()`` received fixes for safer type and encoding handling.
``InvalidChars`` now validates both array keys and values.
XML export now preserves ``0`` and ``'0'`` values.
``SodiumHandler`` error and parameter handling has been normalized for clearer exception behavior.

Thanks to Our Contributors

Many thanks to everyone who contributed fixes and improvements for this release:

@michalsn
@gr8man
@paulbalandan
@memleakd
@xgrind
@ThomasMeschke
@Will-thom

Upgrade Guide
Report Issues

If you run into issues while upgrading, please include your environment details and a small reproducible case when opening a report.

Note: This announcement was created with the assistance of GitHub Copilot (GPT-5.3-Codex).

AI Agent for CodeIgniter best practices and security awareness

Mon, 06 Jul 2026 11:34:02 +0000

Hi everyone,
Has anyone here created or experimented with an AI agent specialized in CodeIgniter development?

I’m thinking about an agent that understands CodeIgniter 4 best practices, secure coding, authentication, validation, database safety, project structure, testing, and code review.

The idea is to use it with tools like Cursor, Codex, Claude, or similar, to help build CodeIgniter applications with better consistency and security awareness.

I’d be interested to hear if anyone has tried this, what worked, what didn’t, and whether you have any prompts, agent structures, or guidelines to share.
Thanks.

prefix changing?

Mon, 06 Jul 2026 05:04:06 +0000

Today I discovered something, that Ubuntu (and Debian) do their own PHP sessions garbage collection but that sessions not prefixed by 'sess_' are ignored. So the CI default session name of 'ci_session' never gets deleted, on my ubuntu box they can be found in /var/lib/php/sessions. The script /usr/lib/php/sessionclean which run every half hour does the cleaning and it was in there that I saw the prefix requirement.