CodeIgniter Form Validation Order

Question

I have a login form with validation that works except for one use case.

If a user enters a valid email address and no password I want only the "The password is required" message to appear but right now both "The password is required" message and the "Incorrect Email/Password" message are appearing.

I understand why but don't know how to change this code so that the callback only runs if the other validation has been passed.

public function login_validation() {
    $this->load->library('form_validation');
    $this->form_validation->set_rules('email', 'Email', 'required|valid_email|trim|xss_clean|callback_validate_credentials');
    $this->form_validation->set_rules('password', 'Password', 'required|md5');
    $this->form_validation->set_error_delimiters('<div class="alert alert-error">', '</div><br />');

    if ($this->form_validation->run()) {
        $data = array(
            'email' => $this->input->post('email'),
            'staff_logged_in' => 1
        );
        $this->session->set_userdata($data);
        redirect('clock/clock');
    } else {
        $this->load->view('login/login');
    }
}

public function validate_credentials() {
    $this->load->model('staff_model');

    if ($this->staff_model->can_log_in()) {
        return true;
    } else {
        $this->form_validation->set_message('validate_credentials', 'Incorrect Email/Password');
        return false;
    }

}

No, no you don't. What you're doing is absolutely correct, just change the message to read something like "sorry that combination of email and password does not match our records" NEVER tell people which portion is wrong, it just gives hackers part of the login. — Rick Calder
Rick, I'm not telling people which part failed. The problem is it is showing them I checked the database before they even entered a password. The callback is being called when the password is empty, I'm trying to avoid the callback completely until the email and password have both passed initial validation. — Rich Coy

Rick Calder Rick Calder · Accepted Answer · 2012-11-08T15:08:55

Don't use the form validation itself for validating the credentials. It's really just meant to validate input from my understanding of it anyway. You'd have to pass the input to the function separately since it's not taking them with the form_validation library. Something like this below.

public function login_validation() {
$this->load->library('form_validation');
$this->form_validation->set_rules('email', 'Email', 'required|valid_email|trim|xss_clean');
$this->form_validation->set_rules('password', 'Password', 'required|md5');
$this->form_validation->set_error_delimiters('<div class="alert alert-error">', '</div><br />');

if ($this->form_validation->run()) {
    $this->validate_credentials($this->input->post($email),$this->input->post($password));
    $data = array(
        'email' => $this->input->post('email'),
        'staff_logged_in' => 1
    );
    $this->session->set_userdata($data);
    redirect('clock/clock');
} else {
    $this->load->view('login/login');
}

}

CodeIgniter Form Validation Order

1 Answers