CodeIgniter 4 Model Callbacks not hashing password before insert - php

Question

I am totally new to CI4 but do have some experience with PHP. I having trouble getting the Model class callback functions to work when inserting a new user row.
Here is the Controller:
<?php use App\Models\UserModel;
class Users extends BaseController
{
public $users_model;
public function __construct() {
$this->users_model = new UserModel();
}
public function register() {
$data = [
'page_title' => 'Register An Account',
'validation' => NULL //must have this set to null until/if any validation rules are broken
];
if ($this->request->getMethod() == 'post') {
//validation rules
$rules = [
'username' => [
'rules' => 'required|min_length[4]|max_length[20]|validateUsername[username]',
'errors' => [
'required' => 'A username is required',
'min_length' => 'Username must be at least {param} characters long',
'max_length' => 'Username cannot be more than {param} characters long',
'validateUsername' => 'Username can only contain letters and numbers',
],
] ,
'email' => [
'rules' => 'required|valid_email|is_unique[users.email]',
'errors' => [
'required' => 'An Email is required',
'valid_email' => 'Enter a valid email',
'is_unique' => 'That email has already been registerd',
],
],
'password' => [
'rules' => 'required|min_length[6]|max_length[16]|validatePassword[password]',
'errors' => [
'required' => 'A password is required',
'min_length' => 'Password must contain at least {param} characters',
'max_length' => 'Password cannot be more than {param} characters in length',
'validatePassword' => 'Password must have at least 1 numeric value',
],
],
'confirm_password' => [
'rules' => 'required|matches[password]',
'errors' => [
'required' => 'Must confirm password',
'matches' => 'Passwords do not match'
],
]
];
if ($this->validate($rules)) {
//all fields passed validation so need to save to the db
$user_data = [
'username' => $this->request->getVar('username', FILTER_SANITIZE_STRING),
'email' => $this->request->getVar('email', FILTER_SANITIZE_EMAIL),
'password' => $this->request->getVar('password')
];
if ($this->users_model->createUser($user_data)) {
echo 'user stored in the db.';
} else {
echo 'user not stored in the db.';
}
} else {
//there are some validation errors
$data['validation'] = $this->validator;
}
}//post request check ends here
return view('users/register', $data);
}// register method ends here.
public function login() {
$data = [
'page_title' => 'Login'
];
return view('users/login', $data);
}
public function logout() {
//not implemented yet
}
}
And here is the Model class:
<?php
namespace App\Models;
use CodeIgniter\Model;
class UserModel extends Model
{
protected $table = 'users';
protected $allowedFields = ['username', 'email', 'password'];
protected $beforeInsert = ['beforeInsert'];
protected $beforeUpdate = ['beforeUpdate'];
protected $allowCallbacks = TRUE;
protected $builder;
public function createUser(array $data) {
$this->builder = $this->db->table($this->table);
$this->db->transStart();
$this->builder->insert($data);
$this->db->transComplete();
if($this->db->affectedRows() == 1) {
return TRUE;
} else {
return FALSE;
}
}
protected function beforeInsert(array $data) {
if (isset($data['data']['password']))
$data['data']['password'] = password_hash($data['data']['password'], PASSWORD_DEFAULT);
return $data;
}
protected function beforeUpdate(array $data) {
if (isset($data['data']['password']))
$data['data']['password'] = password_hash($data['data']['password'], PASSWORD_DEFAULT);
return $data;
}
}
What is weird to me is that the record does get stored in the database but the password is plain text and not hashed. Also, in the controller class, the if statement:
if ($this->users_model->createUser($user_data)) {
echo 'user stored in the db.';
} else {
echo 'user not stored in the db.';
}
Always echo's the 'user not stored in the db' message and the user is stored in the db.
In the model:
if($this->db->affectedRows() == 1) {
return TRUE;
} else {
return FALSE;
}
I have echoed out the result of $this->db->affectedRows()
and it is 1 on a successful insert (although the password is not hashed) so I thought this would cause the method to return true, therefore over in the controller, I would see the truthy part of the if condition, 'user stored in the db'.
Can anyone tell me where I am going wrong in all of this?
I have successfully used the password_hash() function in the controller itself on the $this->request->getVar('password') data so I know it works. But I wanted to leverage the in-built Model callbacks and take care of the hashing for inserts and updates there.
I have also shared/posted this question in the CodeIgniter forums as well.
Thanks for any help.

Answer 1

Codeigniter4 documentation is not really clear about it, but whenever you want a model callback to be triggered, you need to use directly the model functions and not the builder ones.
For example, inside your model, using $this->builder->insert() will NOT trigger the beforeInsert nor the afterInsert functions of your model but using $this->insert() will do the trick.
So in your case you should replace your createUser function with
public function createUser(array $data) {
$this->db->transStart();
$this->insert($data);
$this->db->transComplete();
if ($this->db->affectedRows() == 1) {
return TRUE;
} else {
return FALSE;
}
}