Codeigniter get_csrf_hash() return empty

Question

I try exprimentation with Codeigniter Security Class, because i want to implement any good feature on this framework to avoid my site from SQL Injection and Malicious Attack by hackers out there.

Question:

Why when i try to echo or print_r this get_csrf_hash() , it just not appear anything.

My current codes

My Controller

<?php

class Myclass extends CI_Controller {

  function __construct() {

    parent::__construct();

    $this->load->library('session');
    $this->load->helper('security');
    $this->load->helper('form');

    $this->my_simple_login->chek_login();

  }

  public function index(){

     $this->load->view('/myform');

  } // end index function (show form)

  function submit_form(){

    print_r( $this->input->post('my_input') ); // YEAH

    print_r( $this->input->post('csrf_test_name') ); //empty??

    print_r( $this->security->get_csrf_hash() ); //empty??

  } //end form submitted

} // end class

My View

        <?php
    defined('BASEPATH') OR exit('No direct script access allowed');

    ?><!DOCTYPE html>
    <head></head><body>

<?php
          $attributes = array('class' => 'my_html_class'); // add class to form HTML 
          echo form_open_multipart('myclass/submit_form', $attributes);
          ?>

          <input type="hidden" name="<?php echo $this->security->get_csrf_token_name(); ?>" value="<?php echo $this->security->get_csrf_hash(); ?>">

          <input name="my_input" value="YEAH"/>

          <button type="submit" >SUBMIT FORM</button>

          <?php echo form_close(); ?></body></html>

My CI Config

$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'csrf_test_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = 7200;
$config['csrf_regenerate'] = TRUE;
$config['csrf_exclude_uris'] = array();

If you use form_open_multipart CSRF it is automatically generated you do not need to create another csrf input — , Jun 26 '17 at 21:56
so that's mean, even I'm not create csrf input it's working. But why `get_csrf_hash()` not return anyting (with or not with csrf input on my form). @wolfgang1983 — Kamarul Anuar, Jun 26 '17 at 21:59

score 0 · Accepted Answer · answered Jun 26 '17 at 22:20

0

This problerm fixed. it because I'm not set TRUE to $config['global_xss_filtering'] in Codeigniter config file.

$config['global_xss_filtering'] = TRUE;

answered Jun 26 '17 at 22:20

Kamarul Anuar

312
4
16

Codeigniter get_csrf_hash() return empty

1 Answers1