Fri, 17 Jul 2026 23:36:09 +0000

https://learn.g2.com/best-php-web-frameworks]]>

Thu, 16 Jul 2026 15:15:25 +0000

I didn't find any already existing solution for this.

I created a generate-schema function which generates an output in
php spark tests:generate-schema --output ../tests/_support/Database/Generated/JuryTestTables.php

Code:

        // --- ci_sessions ---

        $this->forge->addField([

            'id'        => ['type' => 'VARCHAR', 'constraint' => 128],

            'ip_address' => ['type' => 'VARCHAR', 'constraint' => 45],

            'timestamp'  => ['type' => 'DATETIME', 'default' => new \CodeIgniter\Database\RawSql('CURRENT_TIMESTAMP')],

            'data'      => ['type' => 'BLOB'],

        ]);

        // $this->forge->addKey('timestamp');

        $this->forge->createTable('ci_sessions', true);

        // --- gx_app_config_options ---

        $this->forge->addField([

            'key'        => ['type' => 'VARCHAR', 'constraint' => 255],

            'value'      => ['type' => 'TEXT'],

            'category_id' => ['type' => 'INT', 'default' => 1],

        ]);

        $this->forge->addPrimaryKey('key');

The code is included in the Migrations, - and loaded upon bootstrapping the phpunit.

Code:
    public function up(): void

    {

        $generatedFile = __DIR__ . '/../Generated/JuryTestTables.php';

Is this something I only see a need for?

Geir

]]>

Sat, 11 Jul 2026 14:35:42 +0000

Docs on autopilot: From zero to self-maintaining with Mintlify]]>

Thu, 09 Jul 2026 18:05:11 +0000

Snowflake, A PRACTICAL GUIDE TO AI AGENTS]]>

Thu, 09 Jul 2026 03:38:50 +0000

https://dev.to/p4nd3m1c/php-is-better-th...fight-36d0]]>

Tue, 07 Jul 2026 09:40:14 +0000

CodeIgniter 4.7.4 Released!

CodeIgniter 4.7.4 is now available.

This patch release focuses on security fixes and stability improvements across HTTP handling, validation, database behavior, sessions, testing, and command tooling. We strongly recommend upgrading as soon as possible.

GitHub Release
Changelog
Version 4.7.4 Notes

Highlights & New Features

Security hardening in request security detection, query builder escaping, uploaded file handling, and upload validation rule behavior.
Safer defaults for file movement and stricter extension/content agreement for upload validation checks.
Targeted reliability fixes in core components used in day-to-day applications.

Notable Enhancements

Database: ``updateBatch()`` now correctly throws an exception when used after unsupported ``where()`` conditions.
HTTP: Safari version detection now uses the ``Version`` token.
Validation: ``required_without`` logic now handles array dot notation correctly and avoids undefined key warnings.
Session: Redis lock retry settings now respect configured retry limits and intervals.
Testing: ``MockInputOutput`` no longer disrupts existing stream filters in test runs.
Commands: ``make:model --return entity`` now preserves sub-namespaces for generated Entities.

Security and Quality

``IncomingRequest::isSecure()`` now trusts ``X-Forwarded-Proto`` and ``Front-End-Https`` only for requests from trusted proxies in ``Config\App::$proxyIPs``.
Query Builder ``deleteBatch()`` now escapes WHERE bind values properly, preventing SQL injection risk when combined with ``where()``.
``UploadedFile::move()`` now sanitizes client-provided filenames when no explicit target name is passed, blocking traversal patterns like ``../../public/shell.php``.
Validation rules ``is_image`` and ``mime_in`` now enforce stronger filename extension checks against detected content.

Security advisories:
GHSA-7wmf-pw8j-mc78
GHSA-c9w5-rwh3-7pm9
GHSA-hhmc-q9hp-r662
GHSA-mmj4-63m4-r6h5

Breaking Changes

There are no intentional framework-level breaking changes in 4.7.4.

Removed Deprecated Items

None in this release.

Other Notable Changes

``env()`` and ``esc()`` received fixes for safer type and encoding handling.
``InvalidChars`` now validates both array keys and values.
XML export now preserves ``0`` and ``'0'`` values.
``SodiumHandler`` error and parameter handling has been normalized for clearer exception behavior.

Thanks to Our Contributors

Many thanks to everyone who contributed fixes and improvements for this release:

@michalsn
@gr8man
@paulbalandan
@memleakd
@xgrind
@ThomasMeschke
@Will-thom

Upgrade Guide
Report Issues

If you run into issues while upgrading, please include your environment details and a small reproducible case when opening a report.

Note: This announcement was created with the assistance of GitHub Copilot (GPT-5.3-Codex).]]>

Mon, 06 Jul 2026 11:34:02 +0000

Has anyone here created or experimented with an AI agent specialized in CodeIgniter development?

I’m thinking about an agent that understands CodeIgniter 4 best practices, secure coding, authentication, validation, database safety, project structure, testing, and code review.

The idea is to use it with tools like Cursor, Codex, Claude, or similar, to help build CodeIgniter applications with better consistency and security awareness.

I’d be interested to hear if anyone has tried this, what worked, what didn’t, and whether you have any prompts, agent structures, or guidelines to share.
Thanks.]]>

Mon, 06 Jul 2026 05:04:06 +0000

Fri, 03 Jul 2026 14:39:00 +0000

I'm experiencing "Allowed memory size of 134217728 bytes exhausted (tried to allocate 17074512 bytes)" in vendor/codeigniter4/framework/system/ThirdParty/Kint/Renderer/RichRenderer.php.
when running the CI (v4.7.1) application in a development environment (CI_ENVIRONMENT = development). There is no problem when running in production environment.
I changed

PHP Code:
defined('CI_DEBUG') || define('CI_DEBUG', true); 

in app/Config/Boot/development.php to:

PHP Code:
defined('CI_DEBUG') || define('CI_DEBUG', false); 

and the problem disappear.
Any ideas on how I can fix the problem without changing the default development configuration? I believe there is something that is causing an infinitive loop or an endless recursion.
Thank you.]]>

Fri, 03 Jul 2026 01:15:52 +0000

I'm experiencing "Array to string conversion" exception when a third party library (PaypalServerSdkLib) is trying to write a log message where one of the elements in $context array argument is an array (another array within $context array). More specifically, the error (warning to be precise) occurs in Logger.php at line 337:

PHP Code:
return strtr($message, $replace); 

That is causing a PHP E_WARNING. Since PHP 8.0 it is not E_DEPRECATED anymore. By default, CI4 is throwing exceptions for the PHP warnings and I don't want to change the default: error_reporting(E_ALL & ~E_DEPRECATED);
So to prevent the PHP warning and the CI exception I inserted the following line in Logger.php at line 307 to convert the array to string before adding it to $replace array used for the strtr call:

PHP Code:
if (is_array($val)) $val = print_r($val, true); 

There are already similar lines to convert GET and POST request parameters from arrays to strings (lines 311 and 312).
Usually I would change the code that is calling the logger but there are multiple log call so I think changing the CI4 Logger to accept arrays is better solution. According to PSR-3 logger interface description, the $content argument is an array and "The array can contain anything.". Presumably, the $content array can contain other arrays so that change complies with the PSR-3 logger interface description.
Can that patch be included in the future CI versions? Will that cause any other problems?
Thank you.]]>

Wed, 01 Jul 2026 18:26:41 +0000

I'm caching some data using the Output class in CodeIgniter 4, but I'm running into an issue where cached content is accessible to unauthenticated users. This seems to be happening because the Output class serves the cached file before the controller is initialized, meaning my authentication checks are bypassed when a cache hit occurs.
Does anyone have suggestions on how to prevent this or properly restrict cached content so it respects user authentication?]]>

Wed, 01 Jul 2026 17:42:59 +0000

Why? I didn't know any better. Now after upgrading from CodeIgniter 3 to 4 I wanted to do it the right way and it used file based session storage by default. Fine.
However, I have now realized that previously without any better knowledge my VPS has session.save_handler "memcached" already preconfigured and a save_path "/data/web/e12345/sockets/memcached-session.sock".
So I was using memcached and I want to use it again, but with the SessionHandler provided by CodeIgniter it does not seem to work, even with these settings:

PHP Code:
public string $driver = MemcachedHandler::class;
public string $savePath = '/data/web/e12345/sockets/memcached-session.sock:11211'; 

ErrorException: ini_set(): open_basedir restriction in effect. File(/data/web/e49159/sockets/memcached-session.sock:11211) is not within the allowed path(s): (/data/web/e49159/html:/data/web/e49159/phpsession:/data/web/e49159/phptmp:/tmp:/usr/bin)
I also tried /data/web/e49159/phpsession but it doesn't work either.
I would rather just use the benefits of the Session handler provided by CodeIgniter using PHP's default settings than having to configure it manually.
Any help would be appreciated!]]>

Tue, 30 Jun 2026 02:45:54 +0000

I'm using CodeIgniter 4 and have both HTTP routes (app/Config/Routes.php) and CLI routes (app/Config/CLI/Routes.php) in the same project.
I noticed that I have a controller method with the same name available for both web requests and CLI commands. My question is about route resolution: if I accidentally define similar route patterns or command names, does CodeIgniter completely isolate HTTP routing from CLI routing, or is there any situation where one definition can override or interfere with the other?
Has anyone tested this behavior in a production project? I'm interested in understanding the exact route lookup order and whether there are any best practices to avoid unexpected conflicts.]]>

Sat, 27 Jun 2026 17:56:44 +0000

Problem:
CodeIgniter 4 Email currently allows setting the visible From header, but not a distinct envelope sender for SMTP MAIL FROM.
Use Cases
Applications that need bounce processing, VERP style addressing, SPF alignment, ESP interoperability.
Setting headers is not equivalent to controlling the SMTP envelope sender. A Return-Path header alone does not reliably affect bounce handling.
Simple example of sending email in CI4:

PHP Code:
$email = \Config\Services::email();
$email->initialize(['protocol'=>'smtp', 'SMTPHost'=>$smtphost]);
$email->setFrom($data['from_email'], $data['from_name'], $data['return_path']);
$email->setTo($data['to']);
$email->setSubject($data['subject']);
$email->setMessage($data['body']);
$email->send(false); 

All good, works greats...but the problem is that this only sets the "From" address of the email itself, it doesn't allow us to modify the envelope sender by specifying a different "MAIL FROM" to the SMTP server. Sadly, the "MAIL FROM" will always be whatever setFrom() is set to. To be clear, this is completely separate from the Return-Path which also works fine in CodeIgniter 4.
Let me first show you my very ugly solution that I've been using for the past 6 months, which works, but I'm sure someone can come up with a better solution. Here's a patch file that can be applied to any recent version of CodeIgniter 4 that provides the functionality that I'm talking about:

Code:
--- /codeigniter4/framework/system/Email/Email.php 2025-12-12 05:37:42.000000000 -0500

+++ /new/Email.php 2026-02-10 08:42:32.515740969 -0500

@@ -1819,7 +1819,7 @@

            return false;

        }

-        if (! $this->sendCommand('from', $this->cleanEmail($this->headers['From']))) {

+        if (! $this->sendCommand('from', $this->cleanEmail((isset($this->headers['X-Bounce-To']) ? $this->headers['X-Bounce-To'] : $this->headers['From'])))) {

            $this->SMTPEnd();

            return false;

In my really ugly workaround, I added support for a "X-Bounce-To" header (nothing meaningful about that header, that's just what I chose). If I set that header, than when the connection is made to the SMTP server, it sends "MAIL FROM whatever-bounce@address.supplied" but my "From" for the message itself remains whatever my "From" header is. That way any bounce back messages, etc. go to the envelope sender address (whatever-bounce@address.supplied). So in other words, I currently use it like this:

PHP Code:
$email = \Config\Services::email();
$email->initialize(['protocol'=>'smtp', 'SMTPHost'=>$smtphost]);
$email->setHeader('X-Bounce-To', 'whatever-bounce@address.supplied');        // <---- To use my patched Email.php code
$email->setFrom($data['from_email'], $data['from_name'], $data['return_path']);
$email->setTo($data['to']);
$email->setSubject($data['subject']);
$email->setMessage($data['body']);
$email->send(false); 

This works perfectly and does exactly what I need....however I know this is not the correct solution. I'm assuming we should actually support something like:

Code:
$email->setEnvelopeFrom('whatever-bounce@address.supplied');

But that's beyond me how that should actually be implemented. To be clear, the existing setFrom() behavior shouldn't change at all unless the new method setEnvelopeFrom() is used, and then just the "MAIL FROM ...." SMTP sender envelope uses that address.
If anything I described above isn't clear enough, please let me know and I can provide more details.
Thanks!]]>

Fri, 26 Jun 2026 22:38:39 +0000

so far the tuts I found on YouTube are not recent, although their titles claims they are .... but they are not (at least the ones I found)
I have tried the blog tutorial on the official CI website, but I get errors and follow it exactly.
The tutorial that I am seeking must be
[] current
[] does not include bootstrap, it throws me off because I do not understand it yet
[] I will be using XAMPP server on my Windows PC
Please ..... I m open to learning this CI4 through whatever resource is available
Thank you all kindly for reading this]]>