Even if it's an AJAX request, you still have to validate the input. It's not you sending your app the input (via AJAX), it's the browser, which you cannot trust.
As a general design principle, avoid special cases (here: ajax vs. non-ajax). In general, you want to treat all cases equally, so you end up with an orthogonal approach.
And as you can see
class SomeController extends Controller { function index() { if(!$this->input->is_ajax_request()) { // validate input <-- XXX here we need to validate it too // load model // create form // pass data to view // ... } else { // validate input // load model // write data to database // return with some json string } } }
this leads to duplicate code (hard to maintain and keep in sync).
Your code, orthogonal approach:
class SomeController extends Controller { function index() { // load model (takes care of his own validation, the self-containment principle of OOP) // coordinate same business logic done by different models // return models/data to the view, the framework will decide whether it uses the html or the json view file } }
Instead, the model (it could be the same model class, or a Form model like there is in Zend Framework, or a hydrating approach like there is in ZF2 could do most of the jobs (together with a Table Gateway, DAO (like in Doctrine 2), or similar classes for models), and you could create two sepparate views for HTML and JSON.
In Zend Framework 2 for instance, the right view is chosen transparently for you, so there really wouldn't be any if/else regarding "is this AJAX or not?".
You should try out a modern PHP framework (5.3+) to get a feel of how to approach the design of your app in PHP.