Mastering CodeIgniter 4 Bab 4: Validasi Input, Form Handling & Proteksi CSRF

Terakhir diperbarui: 27 Agu 2026

In a nutshell: "Bab 4 membahas penerapan sistem validasi data formulir, penanganan flash message feedback untuk pengguna, serta pengamanan transaksi form dari serangan CSRF."

Direct Answer: Validasi di CodeIgniter 4 dilakukan melalui method $this->validate($rules, $messages) di Controller. Proteksi CSRF diaktifkan melalui helper csrf_field() di dalam tag <form> guna memastikan setiap request POST berasal dari sesi pengguna yang sah.

Implementasi Validasi & Simpan Data di Controller

// app/Controllers/Barang.php
public function simpan()
{
    $rules = [
        'kode_barang'  => 'required|min_length[3]|max_length[50]|is_unique[barang.kode_barang]',
        'nama_barang'  => 'required|min_length[3]|max_length[255]',
        'stok'         => 'required|numeric|greater_than_equal_to[0]',
        'harga_satuan' => 'required|numeric|greater_than[0]',
    ];

    $messages = [
        'kode_barang' => [
            'required'  => 'Kode barang wajib diisi!',
            'is_unique' => 'Kode barang ini sudah terdaftar di sistem.'
        ],
        'nama_barang' => [
            'required'   => 'Nama barang tidak boleh kosong!',
            'min_length' => 'Nama barang minimal 3 karakter.'
        ]
    ];

    if (!$this->validate($rules, $messages)) {
        return redirect()->back()->withInput()->with('errors', $this->validator->getErrors());
    }

    $barangModel = new \App\Models\BarangModel();
    $barangModel->save([
        'kode_barang'  => $this->request->getPost('kode_barang'),
        'nama_barang'  => $this->request->getPost('nama_barang'),
        'kategori'     => $this->request->getPost('kategori'),
        'stok'         => (int) $this->request->getPost('stok'),
        'harga_satuan' => (float) $this->request->getPost('harga_satuan'),
    ]);

    session()->setFlashdata('success', 'Data barang berhasil ditambahkan ke inventaris!');
    return redirect()->to('/barang');
}

Formulir HTML Aman dengan CSRF Protection

<?= $this->extend('layout/main') ?>

<?= $this->section('content') ?>
<div class="card p-4 max-w-lg mx-auto shadow-sm">
    <h4 class="mb-3">Tambah Stok Barang Baru</h4>

    <?php if (session()->getFlashdata('errors')): ?>
        <div class="alert alert-danger">
            <ul class="mb-0">
            <?php foreach (session()->getFlashdata('errors') as $error): ?>
                <li><?= esc($error) ?></li>
            <?php endforeach; ?>
            </ul>
        </div>
    <?php endif; ?>

    <form action="/barang/simpan" method="POST">
        <!-- Token CSRF Otomatis -->
        <?= csrf_field() ?>

        <div class="mb-3">
            <label class="form-label">Kode Barang</label>
            <input type="text" name="kode_barang" class="form-control" value="<?= old('kode_barang') ?>" required>
        </div>

        <div class="mb-3">
            <label class="form-label">Nama Barang</label>
            <input type="text" name="nama_barang" class="form-control" value="<?= old('nama_barang') ?>" required>
        </div>

        <div class="row mb-3">
            <div class="col">
                <label class="form-label">Stok Awal</label>
                <input type="number" name="stok" class="form-control" value="<?= old('stok', 0) ?>">
            </div>
            <div class="col">
                <label class="form-label">Harga Satuan (Rp)</label>
                <input type="number" step="100" name="harga_satuan" class="form-control" value="<?= old('harga_satuan') ?>">
            </div>
        </div>

        <button type="submit" class="btn btn-success w-100">💾 Simpan Data Barang</button>
    </form>
</div>
<?= $this->endSection() ?>