Baseline: main 23.0+ · Verified: main 26.800.0
| Task | Read |
|---|---|
Application, Context, site, language, session access |
rules/application-context.md |
| Reading query, form, headers, cookies, files, JSON body | rules/request.md |
HttpResponse, Json/AjaxJson, redirect, files, cookies, Converter |
rules/response.md |
Uri, UuidGenerator |
rules/uri-uuid.md |
Invariants
- Request data only via
$this->getRequest()(controllers) orContext::getCurrent()->getRequest(). Never$_GET/$_POST/$_COOKIE/$_SERVER. - Use the getter for the known source (
getQuery/getPost/getHeader/getCookie).get()merges query and form only. - A JSON body is not in
get()/getPost()and is bound to action params only inJsonController:getJsonList()orJsonPayload. - Filtered values (
$request['x']) are not escaped: cast, validate, escape on output. - Output via response objects (
HttpResponse,Engine\Response\*), notheader()/echo json_encode().