CodeIgniter 4 application development

CodeIgniter 4 Conventions

Structure

• Keep the app/ layout (Controllers, Models, Views, Config, Filters, Entities, Libraries, Database) with App\ namespaces matching folders. Never edit system/ or vendor/.
• Controllers extend BaseController, stay thin and return view(), $this->response->setJSON() or redirect(). Business logic goes in models, entities, libraries or services.
• Generate files with php spark make:controller, make:model, make:migration, make:filter so namespaces and stubs are right.

Routing

• Define every route explicitly in app/Config/Routes.php with HTTP verbs ($routes->get, post, put, delete), groups, names and filters. Use $routes->resource() or presenter() for CRUD where the repo does.
• Keep auto-routing off ($routes->setAutoRoute(false), or $autoRoute = false in app/Config/Routing.php on 4.4+). Never turn on legacy auto-routing.
• Use placeholders such as (:num) and (:segment).

Models and data

• Extend CodeIgniter\Model with $table, $primaryKey, $returnType (array or an Entity), $useTimestamps and $useSoftDeletes as the repo does.
• $allowedFields lists exactly the columns allowed for mass assignment; never insert or update the raw request array without it.
• Validation: $validationRules and $validationMessages on the model, or $this->validate() / validateData() in the controller. Check the result and show the errors.
• Query Builder with bindings: where('id', $id), whereIn(), or $db->query($sql, [$a, $b]). Never concatenate input into SQL; allowlist column and sort names from input.
• Wrap multi-step writes in $db->transStart() / transComplete().

Security

• Enable the csrf filter for POST requests in app/Config/Filters.php; put csrf_field() in forms and send the token header with AJAX.
• Authentication and permissions through filters on route groups (Shield's session, group and permission filters if used), plus per-record checks in controllers.
• Escape every view value with esc() in the right context: esc($v), esc($v, 'attr'), esc($v, 'url'), esc($v, 'js').
• Read input through $this->request->getPost(), getGet(), getJSON() or getVar(), not superglobals.

Services and config

• Reach framework services with service('name') or Config\Services; register your own shared services in app/Config/Services.php for testability.
• Settings live in app/Config classes, read with config('Name'). Environment-specific values go in .env (CI_ENVIRONMENT, app.baseURL, database.default.*). Add new keys to the env template file; never commit .env.

Migrations and seeders

• One change per migration via php spark make:migration, with up() and down() using Forge. Never edit migrations that already ran elsewhere.
• Seeders for development and test data, run with php spark db:seed locally. Never run migrate:refresh or migrate:rollback against shared databases.

Testing

• Extend CodeIgniter\Test\CIUnitTestCase. For database tests use DatabaseTestTrait with $migrate, $refresh and $seed on the tests database group.
• HTTP tests with FeatureTestTrait: $this->get(), post(), withSession(), withHeaders(), then assertStatus(), assertSee(), assertJSONFragment(), assertRedirect().
• Replace services with Services::injectMock().
• Run vendor/bin/phpunit or the composer test script.

Before you finish

• Routes defined explicitly in app/Config/Routes.php; auto-routing off.
• $allowedFields and validation rules cover changed models.
• Queries use Query Builder bindings.
• CSRF and auth filters applied; view output escaped with esc().
• Migrations and seeders created with spark; old migrations untouched.
• CIUnitTestCase / FeatureTestTrait tests added and run.