Using Codeigniter Form Validation with Web Service

The main issue I see with the code above is the spaghetti factor, as it's blocking view on what's important. What are you trying to do?

1. Display a form with a submit button.
2. Receive data from form at a certain URL/action.
3. Validate form.
   1. If data is invalid, display form and inform user of mistakes.
   2. If data is valid, send data to webservice.
      1. If data is invalid, redirect user to form and inform of invalid user/pass combo.
      2. If data is valid, save some data in the session to store the authentication factor.

Let's not focus on steps 1 and 2 since they are most likely already working. So let's discuss form validation.

$this->form_validation->set_rules('username', 'USERNAME', 'required|is_unique[username]');
$this->form_validation->set_rules('password', 'PASSWORD', 'required|matches[password]');

Remember, at this stage you're validating the form, you do not have access to a relational database (since the data is retrieved via webservice and ideally on a different sever) and you just want to make sure that the username and password fields in the form have been filled in. You just want to make sure that they are provided and perhaps, that they are of a particular length. Let's revisit the code above.

$this->form_validation->set_rules('username', 'USERNAME', 'required|min_length[5]');
$this->form_validation->set_rules('password', 'PASSWORD', 'required|min_length[5]');

Remember, you're only validating the data that you've received through your form at this stage - you don't care about what happens on the webservice end, that end worries about providing that service.

Next we need to see what we're going to do in case the form validation failed or succeeded. The basic plan that we have at the moment is:

if ($this->form_validation->run() == FALSE) {
    //Username or password field were not provided or they were too short.
    //Render form and display errors.
} else {
    //Username and password field have been provided and they were within the length requirements.
    //Call cURL library and call webservice.
    //Retrieve webservice response.

    if ($response == 'valid') {
        //Webservice told us that username/password combo was right!
        //Store some data in the session to authenticate user.
    } else {
        //Webservice response told us that username/password combo is not right.
        //Render login form and inform user that user/pass combo were not correct.
    }
}

We just have comments for now - that's our plan, right? We've validated that we got some proper input from the user (input sanitizing) and now we want to see if those values were correct.

But now, instead of adding in all those blocks of code, let's do some good design and use models for it!

if ($this->form_validation->run() == FALSE) {
    //Username or password field were not provided or they were too short.

    $this->load->view('myview');
} else {
    //Username and password field have been provided and they were within the length requirements.

    $username = $this->input->post('username');
    $password = $this->input->post('password');

    // Make call to webservice with parameters to check if the credentials are correct or not.
    $response = $this->muser->checkLoginCredentials($username, $password)

    if ($response->valid == 'valid') {
        //Webservice told us that username/password combo was right!

        $this->muser->storeLoginCredentials($response->fullName, $response->email, $response->username);
    } else {
        //Webservice response told us that username/password combo is not right.

        $data['error'] = 'Invalid username/password combination';
        $this->load->view('myview', $data);
    }
}

Our code is super clear now! We only need to create the Muser model and make sure that it has two methods:

• checkLoginCredentials: makes a call to the webservice with a username and password which we know are sanitized and retrieves the response.
• storeLoginCredentials: given some parameters from the webservice response, store that data in a session.

Now, why did your code not work the first time?

• You had a is_unique[username] rule on the username, but you're not interacting with a database, which that is used for. You're not checking if the username is unique, you just want a webservice to tell you if your login credentials are correct.
• You also had a matches[password] rule on the password, which does nothing. You were perhaps thinking of having a _password_confirmation_ field, and yes, the rule would apply there.

Sorry for the long write-up, hope it helps and clears up more things along the way. If I can help with more info, comment and I'll update the answer!

i think what you want is named a "callback" see here http://ellislab.com/codeigniter/user-guide/libraries/form_validation.html#callbacks

First make sure your curl rest code is working correctly. Just have it echo out true or false or something simple so you verify its results.Then integrate it into your callback.

going from the example in the manual where they name it: callback_username_check

 function username_check($str){

 // send the user name to the service 
 if ( $this->_sendUserName($str) == true ) 
 { return true ; } 

 else{ 
  // customize the message with something 
  $this->form_validation->set_message('username_check', 'The %s is incorrect so have another cup of coffee and try again');
  return false ; } 

 }

Note that i'm calling a separate method that just has the rest/curl code. that way if your service changes, you don't have to change the callback.

edit - i just used the example of "username" to make it consistent with the example in the guide.

if you need to send both username and password to the service, my suggestion would be to do basic validation on the username, and then do the callback for the password. so the value for the password is coming from the callback and then get the value of username from

   $username = $this->input->post('username', TRUE);

you can use $this->input->post() anywhere before or after validation. the TRUE xss cleans it.

usually if someone messes up a user name & password, its the password that is incorrect. so by doing the validation with a callback, if it fails - when you show the form again - the user name will still be filled out. AND if you are getting information back from the service as to why it failed - you can customize the error message that is displayed with that information.