ci4-forms¶

A form builder for CodeIgniter 4.7+. Define a form once in PHP, and the package renders it with Bootstrap 5, validates it with CodeIgniter's own Validation service, puts the user's input back after an error, and hands you only clean data for the fields you defined.

composer require ephraitech/ci4-forms

A complete example¶

A contact form that saves messages to the database. The form is a class:

<?php

declare(strict_types=1);

namespace App\Forms;

use Ephraitech\Forms\Form;

class ContactForm extends Form
{
    protected function define(): void
    {
        $this->text('full_name', 'Full name')
            ->rules('required|max_length[100]')
            ->autocomplete('name');

        $this->email('email', 'Email address')
            ->rules('required|valid_email|max_length[150]')
            ->autocomplete('email');

        $this->select('topic', 'Topic', [
            'booking' => 'A booking',
            'pricing' => 'Prices',
            'other'   => 'Something else',
        ])
            ->placeholder('Choose a topic')
            ->rules('required');

        $this->textarea('message', 'Message')
            ->rows(5)
            ->rules('required|max_length[2000]');

        $this->submit('Send message');
    }
}

The controller shows the form, and saves it when it is valid:

<?php

declare(strict_types=1);

namespace App\Controllers;

use App\Forms\ContactForm;
use App\Models\ContactMessageModel;
use CodeIgniter\HTTP\RedirectResponse;

class Contact extends BaseController
{
    public function index(): string
    {
        return view('contact', ['form' => new ContactForm()]);
    }

    public function send(): RedirectResponse|string
    {
        $form = new ContactForm();

        if (! $form->validate()) {
            return view('contact', ['form' => $form]);
        }

        model(ContactMessageModel::class)->insert($form->validated());

        return redirect()->to('/contact')->with('message', 'Thank you. We will reply within one working day.');
    }
}

The view prints the whole form, including labels, error messages, the CSRF field and Bootstrap classes:

<h1>Contact us</h1>

<?php if (session('message')): ?>
    <div class="alert alert-success"><?= esc(session('message')) ?></div>
<?php endif ?>

<?= $form ?>

Two routes connect them:

<?php

/** @var \CodeIgniter\Router\RouteCollection $routes */
$routes->get('contact', 'Contact::index');
$routes->post('contact', 'Contact::send');

What happens when someone submits¶

• If anything is invalid, the same page comes back with each error under its field and everything the visitor typed still filled in.
• validated() returns only the four fields the form defines, trimmed, with empty optional values as null. Anything else a visitor adds to the request, such as an is_admin field, never reaches the model.
• The topic must be one of the three options. A value sent from the browser's developer tools, like free_suit, is rejected without you writing a rule for it.

What the package covers¶

Forms in code

Text, email, number, date and time, select and multi-select, radio and checkbox groups, file uploads, custom field types, and layouts with rows and sections. Rules come from CodeIgniter's Validation; HTML attributes such as required and maxlength follow from them.

Safe by default

Output is escaped, unknown request keys are dropped, choices are checked against their options, passwords are never written back into a page, and uploads are checked by their real content.

Forms as data

A form can also be a JSON schema stored in a file or a database, so admins and clients can edit forms without code. Schemas written by admins are checked against a restrictive policy that blocks anything that could harm the site or its visitors.

Showing what was submitted

Stored submissions are shown with the form's labels and option texts, so admins read "Prices" instead of pricing.

Requirements¶

• PHP 8.2 or newer
• CodeIgniter 4.7 or newer
• Bootstrap 5 on your pages, for the default look (the markup works without it)

Continue with Installation.