How to Hire a Backend Developer (CodeIgniter)

• aLeave auto-routing on and add an Apache rewrite that 404s /home/appointments, because the framework will then pick the intended controller.
• bSet auto-routing off in Routes.php and declare an explicit PUT appointments/(:num) route to Appointments::update so only that method can write slot 4412.Correct
• cRename Home::appointments to appointmentsLegacy and keep auto-routing, since method names are not part of the public URL contract.
• dPut exit in Home::__construct so every unmatched URI dies before a wrong write, then keep discovering controllers by URI segments.

Explanation: b is the CI4 production default: disable auto-routing and list HTTP method plus path. a still leaves Home reachable through other entry points. c is a rename lottery; any new public method becomes a URL. d turns routing mistakes into a full outage. The colliding plot is leftover public methods plus auto-routing, not 'what is a route'.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aKeep auth global and add CORS only in the controller method, because filters cannot run on OPTIONS.
• bRemove auth from the entire API group and rely on HTTPS, because CORS and authentication are the same control.
• cRun a CORS/OPTIONS filter before auth, skip auth on OPTIONS, and attach CORS headers on the Response; do not let the auth before-filter abort the preflight.Correct
• dConvert OPTIONS into GET in index.php so auth can treat preflight as a read of /.

Explanation: c respects filter order: a global auth before-filter aborts before the controller can add CORS. a never runs if auth already returned 401. b drops the credential gate. d breaks HTTP semantics. Hybrid: CORS preflight rule plus CI4 global before-filters.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aKeep getPost; CodeIgniter always hydrates $_POST from a JSON Content-Type, so qty 0 will fail greater_than automatically.
• bCast (int) $this->request->getVar('qty') and skip the Validation service because 0 is already an integer.
• cRead the body with getJSON(true) or getRawInputVar, run validateData / the Validation service on that array, and reject qty 0 with a 422 JSON body — not an HTML error page.Correct
• dCall $_POST['qty'] = json_decode(file_get_contents('php://input'))->qty inside the model so validation stays in Active Record.

Explanation: c is the JSON API pattern: getPost is empty for a raw JSON body, so required can fail for the wrong reason or never see qty. a is false for typical CI4 JSON. b skips the business rule greater_than[0]. d bypasses the request layer and still does not return a consistent envelope. Numbers: qty 0 must 422, not insert.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aCopy the SQL into a second controller method that json_encode's the same string-built query, and keep echo in the HTML method.
• bMove the query into a model or service that returns rows; keep the controller thin and choose HTML view versus $this->response->setJSON; do not put SQL in the view or branch on Accept inside the query string.Correct
• cMove the SQL into the PHP view and switch on the Accept header there so MVC 'views own formatting and data'.
• dAdd a helper that echo json_encode($_GET) so mobile can bypass the HTML controller entirely.

Explanation: b is MVC: model owns the unpaid-invoice query, controller picks representation. a duplicates SQL. c puts data access in the view. d dumps GET. The colliding goals are one query of record versus two clients in three weeks.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aCodeIgniter lowercases the first segment and maps admin to a reserved PHP keyword, so Admin controllers are illegal.
• bFirst matching route wins: (:segment) already consumed /admin, so the later static admin route is dead code.Correct
• cStatic routes always outrank placeholders regardless of registration order, so the bug must be in .htaccess.
• dYou must call setTranslateURIDashes(true) or dashed URIs steal admin.

Explanation: b is the CI4 matcher: order is priority, and a greedy placeholder listed first hides a later literal. a is folklore. c is the opposite of the engine. d is a different flag. Theoretical: route-order rule, not a clinic story.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aResourceController cannot emit 201; you must name the method store() like Laravel.
• becho already sent a body and headers; respondCreated cannot set 201/Location on a committed response. Return only the Response — setJSON plus 201, or respondCreated without echo.Correct
• cYou must call header('HTTP/1.1 201') and die() because Response is display-only.
• dPOST /items is reserved for CLI spark and cannot be used over HTTP.

Explanation: b is the output trap: echo commits PHP's response before CI's Response object. a is a Laravel name, not CI ResourceController. c abandons the Response layer. d is false. Practical: POST create status vs accidental echo.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• a$allowedFields only gates timestamps; role always writes because it is a column.
• bSoft deletes automatically deny privilege columns on insert.
• cKeep role out of $allowedFields on the public path; set a default role in PHP after insert of email/password only. allowedFields is a denylist of mass-assignable names, not a substitute for authz.Correct
• dEntities reject role unless $casts includes 'admin'.

Explanation: c is CI4 mass assignment: anything in allowedFields can be inserted from request JSON. a misstates the property. b confuses deleted_at. d invents a cast. Hybrid: named $allowedFields rule plus a signup JSON body that smuggles role.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.

• aPHP views auto-escape like Laravel Blade {{ }}, so the img tag is already safe.
• bPrint <?= esc($note) ?> (html context). Do not echo raw request or DB strings into invoices; esc is not optional because CI4 PHP views are not auto-escaped.Correct
• chtmlspecialchars is forbidden inside CI views; only the Parser with {note} is allowed.
• dMove the note into a .css file so XSS cannot run.

Explanation: b is accurate: CI4 PHP views do not auto-escape; esc() or the Parser's escaping does. a confuses frameworks. c is false. d does not remove HTML context. Practical XSS in a print view, not a definition of MVC.

Why it matters: Evaluates practical understanding of CodeIgniter core principles, execution model, and runtime characteristics in production.