CodeIgniter 4 Controllers

When to use

• The user wants a CodeIgniter controller to extend BaseController to share helpers, models, and services across actions.
• The user needs to handle an incoming HTTP request in CodeIgniter 4 by writing a controller class and action method.
• The user needs a CodeIgniter controller action to return a view, JSON, or redirect using the response service.

When NOT to use

• Do not use this skill to place heavy business rules or persistence logic inside the controller; that belongs in a model or service class.
• Do not apply this skill to CodeIgniter 3 projects; CI3 uses CI_Controller, the loader, and a different request model.

Core guidance

• Extend BaseController, not the framework Controller directly — Have app controllers extend App\Controllers\BaseController rather than CodeIgniter\Controller directly, and put shared helpers, models, and services in initController() or properties on BaseController.
• Return the response object instead of echoing output — Return a value from the action — view(...), $this->response->setJSON(...), or redirect()->to(...) — instead of calling echo or print directly.

Quick recipe

1. Create App\Controllers\Widgets extends BaseController and add a public action method such as show($id) that the router can reach. (verify: Visiting the mapped route reaches the action)
2. Inside the action, read input via $this->request->getVar('id') and fetch data with model(WidgetModel::class)->find($id) instead of querying inline. (verify: The action returns model data for a known id)
3. Return view('widgets/show', $data) for HTML or $this->response->setJSON($data) for an API, and use $this->response->setStatusCode(404) when a record is missing. (verify: A missing record yields a 404, not a 200 with an empty body)

Best practices

• Add a _remap($method, ...$params) method only when you must intercept how a controller dispatches to its actions; otherwise let the router call the method
• Read input with $this->request->getPost('key'), getGet(), or getVar() instead of touching $_POST, $_GET, or $_REQUEST directly
• Keep each action small: read input, call a model or service for domain work, then return a response

Anti-patterns

See references/anti-patterns.md.

Common mistakes

1. Request is not ready in the constructor — Reading $this->request inside a controller __construct() fails because the request is injected later. Fix: Do setup that needs the request in initController() or the action, not in the constructor.
2. Echoing output breaks status codes and filters — Calling echo in an action sends body bytes before CodeIgniter finalizes the response. Fix: Return view(...) or a response object; let CodeIgniter emit the body during finalization.
3. Every public method is a routable endpoint — With auto-routing, any public controller method becomes a URL-reachable endpoint. Fix: Mark helpers protected/private, or disable auto-routing and declare only intended routes explicitly.

Version notes

• CI4 introduced BaseController and initController — CodeIgniter 4.0 replaced CI3 CI_Controller with a namespaced BaseController and an initController() lifecycle hook.

Security

• Not applicable — no I/O, auth, or untrusted input.

Testing

• Activation and decision behavior are verified in eval/scenarios/codeigniter/controllers.yaml.

Additional resources

• references/anti-patterns.md
• references/core.md
• references/examples.md
• references/pitfalls.md
• references/recipes.md
• references/version-differences.md

Knowledge graph

Related: codeigniter/routing, php/typed-properties