Form Method Spoofing in CodeIgniter - codeigniter

Question

So I wanna use HTTP DELETE on my route when deleting the data.
Is it possible to use method spoofing in CodeIgniter?
Maybe like Laravel does by using hidden input "_method" ?
<input type="hidden" name="_method" value="DELETE">
Is there any suggestion how to do this in CodeIgniter?
Cheers.

Answer 1

I just noticed this feature in Laravel docs, googled and found this question. I'll share my implementation in CI 3.0+ (maybe 2.0+).
File: application/helpers/MY_form_helper.php
<?php defined('BASEPATH') OR exit('No direct script access allowed');
if ( ! function_exists('method_field')) {
function method_field($method)
{
return '<input type="hidden" name="__method" value="'.$method.'">';
}
}
File: application/config/routes.php
<?php defined('BASEPATH') OR exit('No direct script access allowed');
$route['default_controller'] = 'home';
$route['404_override'] = '';
$route['translate_uri_dashes'] = FALSE;
// seperate controllers in HTTP VERB sub-folders
$route['(.+)']['GET'] = 'get/$1';
$route['(.+)']['POST'] = 'post/$1';
$route['(.+)']['PUT'] = 'put/$1';
$route['(.+)']['PATCH'] = 'patch/$1';
$route['(.+)']['DELETE'] = 'delete/$1';
File: application/core/MY_Router.php
<?php defined('BASEPATH') OR exit('No direct script access allowed');
protected function _parse_routes()
{
// Turn the segment array into a URI string
$uri = implode('/', $this->uri->segments);
// Get HTTP verb
$http_verb = isset($_SERVER['REQUEST_METHOD']) ? strtolower($_SERVER['REQUEST_METHOD']) : 'cli';
// ::: START EDIT (Form Method Spoofing) :::
$_request_method = strtolower(isset($_POST['__method']) ? $_POST['__method'] : isset($_GET['__method']) ? $_GET['__method'] : NULL);
if ( ! empty($_request_method) && in_array($_request_method, ['get', 'post', 'put', 'patch', 'delete'])) {
$http_verb = $_request_method;
}
// ::: END EDIT (Form Method Spoofing) :::
// Loop through the route array looking for wildcards
foreach ($this->routes as $key => $val)
{
// Check if route format is using HTTP verbs
if (is_array($val))
{
$val = array_change_key_case($val, CASE_LOWER);
if (isset($val[$http_verb]))
{
$val = $val[$http_verb];
}
else
{
continue;
}
}
// Convert wildcards to RegEx
$key = str_replace(array(':any', ':num'), array('[^/]+', '[0-9]+'), $key);
// Does the RegEx match?
if (preg_match('#^'.$key.'$#', $uri, $matches))
{
// Are we using callbacks to process back-references?
if ( ! is_string($val) && is_callable($val))
{
// Remove the original string from the matches array.
array_shift($matches);
// Execute the callback using the values in matches as its parameters.
$val = call_user_func_array($val, $matches);
}
// Are we using the default routing method for back-references?
elseif (strpos($val, '$') !== FALSE && strpos($key, '(') !== FALSE)
{
$val = preg_replace('#^'.$key.'$#', $val, $uri);
}
$this->_set_request(explode('/', $val));
return;
}
}
// If we got this far it means we didn't encounter a
// matching route so we'll set the site default route
$this->_set_request(array_values($this->uri->segments));
}
Note:
With the routing structure in application/config/routes.php, you can have same controller names for all HTTP VERBs!
Simply load the form helper with $this->load->helper('form') to use the <?= method_field('PUT') ?> in your views or use <input type="hidden" name="__method" value="PUT">.
I used the hidden form field name __method instead of Laravel's _method because it is possible to use such field name (+ double underscore is so CodeIgniter-ish).
This EDIT can also spoof GET requests too. EG: http://project-name/controller/action?__method=PATCH will initiate a PATCH controller instead!