Professional CodeIgniter

Chapter 3: A 10,000 - Foot View of CodeIgniter

51

$config[‘cache_path’] = ‘’;

$config[‘encryption_key’] = “enter_a_32_character_string_here”;

$config[‘sess_cookie_name’] = ‘ci_session’;

$config[‘sess_expiration’] = 7200;

$config[‘sess_encrypt_cookie’] = TRUE;

$config[‘sess_use_database’] = FALSE;

$config[‘sess_table_name’] = ‘ci_sessions’;

$config[‘sess_match_ip’] = FALSE;

$config[‘sess_match_useragent’] = TRUE;

$config[‘cookie_prefix’] = “”;

$config[‘cookie_domain’] = “”;

$config[‘cookie_path’] = “/”;

$config[‘global_xss_filtering’] = TRUE;

$config[‘compress_output’] = FALSE;

$config[‘time_reference’] = ‘local’;

$config[‘rewrite_short_tags’] = FALSE

For more details on each of these configuration options, simply read the comments embedded in /

system/application/config/config.php. You will also get more detail on certain settings as you work

through the sections of the book and tweak the configuration as needed. For example, at some point, you

will want to use encryption for security purposes or set your logging threshold for debugging, and they

both require making changes to this file.

CodeIgniter ’ s Global XSS Filtering option is set to FALSE by default. The online User Guide suggests

that setting this to TRUE adds a lot of performance overhead to the system. However, at this point, it is

better to have some global protection put in place. That way you can be assured of some security

precautions while you ’ re in development. Chapter 9 discusses security issues in more depth, but for

now, it ’ s good to have something in place while you ’ re developing.

In the same security vein, notice that sess_encrypt_cookie has been set to TRUE, and that you are to

enter a 32 - character encryption salt in encryption_key. Doing these two things will encrypt any

sessions and provide a salt for any hashing methods you use. Be sure to use a random string of upper -

and lowercase letters and numbers. More information on encryption is covered in Chapter 9 , but for

now, it ’ s good to incorporate this level of security awareness in your process.

One final note before moving on: Make sure that you write down your encryption key and keep it safe

somewhere, or, at least, maintain good backups. You ’ ll need the key to retrieve other information, so if

your site is compromised or erased (or if you lose your key any other way), you ’ ll be glad you have a

record of it.

database.php

The database.php file contains all the information required to connect to a database. Currently, CodeIgniter

supports mysql, mysqli, postgres, odbc, and mssql connections. To connect to your database, simply

enter valid information for your hostname, username, password, database name, and database driver.

Each of these is stored in the $db array under the “ default ” group, which means you could have

numerous connection groups, each with their own unique name. For example, you could have one set of

connection variables for your development environment and another for your production environment.

As long as you ’ ve set the $active_group variable correctly, your application will keep connected.