Kohana input & validation libraries - overlap?

Question

I'm familiarizing myself with Kohana. I've been reading up on the Input library, which automatically pre-filters GET and POST data for me, and the Validation libary, which helps with form filtering and validation.

Should I use both together? The examples given in the Validation library documentation use the unfiltered $_POST array instead of $this->input->post(). Seems to me it would be more secure to chain the two, but the two sets of documentation seem to make no mention of each other, so I don't know if this would be redundant or not.

Answer 1

The $_POST, $_GET, and $_COOKIE globals are pre-sanitized if global XSS filtering is turned on (it's on by default). That's one of the reasons why your code extends the Kohana classes, so that housekeeping stuff like input sanitization is taken care of for you. They encourage use of the input library methods, though, so there's no reason not to use them. They may just use $_POST in the validation examples because they want to explain the different libraries independent of one another.

Their code to instantiate a validation class should be:

$post = new Validation( $this->input->post() );

And yes, by all means use them together! It's all meant to fit together nicely.

Answer 2

Yes, use both of them together.