|null $arguments
+ *
+ * @return void
+ */
+ public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+ {
+ // ...
+ }
+}
+```
+
+When run, this method first grabs an instance of the throttler. Next, it uses the IP address as the bucket name, and sets the limit to one request per second. If the throttler rejects the check, returning false, then we return a Response with the status code set to 429 - Too Many Requests, and the script execution ends before it ever hits the controller. This example will throttle based on a single IP address across all requests made to the site, not per page.
+
+### Applying the Filter
+
+We don't necessarily need to throttle every page on the site. For many web applications, it makes the most sense to apply this only to POST requests, though APIs might want to limit every request made by a user. In order to apply this to incoming requests, you need to edit **app/Config/Filters.php** and first add an alias to the filter:
+
+```php
+ \App\Filters\Throttle::class,
+ ];
+
+ // ...
+}
+```
+
+Next, we assign it to all POST requests made on the site:
+
+```php
+ ['throttle'],
+ ];
+
+ // ...
+}
+```
+
+!!! warning "Warning"
+ If you use `$methods` filters, you should [disable Auto Routing (Legacy)](../incoming/routing.md#use-defined-routes-only) because [Auto Routing (Legacy)](../incoming/routing.md#auto-routing-legacy) permits any HTTP method to access a controller. Accessing the controller with a method you don't expect could bypass the filter.
+
+And that's all there is to it. Now all POST requests made on the site will be rate limited.
+
+## Class Reference
+
+#### check(string $key, int $capacity, int $seconds[, int $cost = 1])
+
+- **Parameters**
+ - **$key** `string` The name of the bucket
+ - **$capacity** `int` The number of tokens the bucket holds
+ - **$seconds** `int` The number of seconds it takes for a bucket to completely fill
+ - **$cost** `int` The number of tokens that are spent on this action
+
+- **Returns**: true if the action can be performed, false if not
+
+- **Return type**: `bool`
+
+Checks to see if there are any tokens left within the bucket, or if too many have been used within the allotted time limit. During each check the available tokens are reduced by `$cost` if successful.
+
+#### getTokenTime()
+
+- **Returns**: The number of seconds until another token should be available.
+- **Return type**: `integer`
+
+After `check()` has been run and returned false, this method can be used to determine the time until a new token should be available and the action can be tried again. In this case, the minimum enforced wait time is one second.
+
+#### remove(string $key) : self
+
+- **Parameters**
+ - **$key** `string` The name of the bucket
+
+- **Returns**: `$this`
+
+- **Return type**: `self`
+
+Removes & resets the bucket. Won't fail if the bucket doesn't exist.
diff --git a/docs/libraries/time.md b/docs/libraries/time.md
new file mode 100644
index 000000000000..e0a7f7a3c964
--- /dev/null
+++ b/docs/libraries/time.md
@@ -0,0 +1,758 @@
+# Times and Dates
+
+CodeIgniter provides a fully localized, immutable date/time class that is built on PHP's DateTimeImmutable class, but uses the Intl extension's features to convert times across timezones and display the output correctly for different locales. This class is the `Time` class and lives in the `CodeIgniter\I18n` namespace.
+
+!!! note "Note"
+ Since the Time class extends `DateTimeImmutable`, if there are features that you need that this class doesn't provide, you can likely find them within the [DateTimeImmutable](https://www.php.net/manual/en/class.datetimeimmutable.php) class itself.
+
+!!! note "Note"
+ Prior to v4.3.0, the Time class extended `DateTime` and some inherited methods changed the current object state. The bug was fixed in v4.3.0. If you need the old Time class for backward compatibility, you can use the deprecated `TimeLegacy` class for the time being.
+
+## Instantiating
+
+There are several ways that a new Time instance can be created. The first is simply to create a new instance like any other class.
+
+When you do it this way, you can pass in a string representing the desired time. This can be any string that PHP's [DateTimeImmutable](https://www.php.net/manual/en/class.datetimeimmutable.php) constructor can parse. See [Supported Date and Time Formats](https://www.php.net/manual/en/datetime.formats.php) for details.
+
+```php
+toLocalizedString('MMM d, yyyy'); // March 9, 2016
+
+// Locale: fa
+$time = Time::parse('March 9, 2016 12:00:00', 'America/Chicago');
+echo $time->toLocalizedString('MMM d, yyyy'); // مارس ۹, ۲۰۱۶
+```
+
+### toDateTimeString()
+
+This is the first of three helper methods to work with the [IntlDateFormatter](https://www.php.net/manual/en/class.intldateformatter.php) without having to remember their values. This will return a localized version of a string formatted as `Y-m-d H:i:s`:
+
+```php
+toDateTimeString(); // 2016-03-09 12:00:00
+
+// Locale: fa
+$time = Time::parse('March 9, 2016 12:00:00', 'America/Chicago');
+echo $time->toDateTimeString(); // ۲۰۱۶-۰۳-۰۹ ۱۲:۰۰:۰۰
+```
+
+### toDateString()
+
+Displays just the localized date portion of the Time:
+
+```php
+toDateString(); // 2016-03-09
+
+// Locale: fa
+$time = Time::parse('March 9, 2016 12:00:00', 'America/Chicago');
+echo $time->toDateString(); // ۲۰۱۶-۰۳-۰۹
+```
+
+### toTimeString()
+
+Displays just the localized time portion of the value:
+
+```php
+toTimeString(); // 12:00:00
+
+// Locale: fa
+$time = Time::parse('March 9, 2016 12:00:00', 'America/Chicago');
+echo $time->toTimeString(); // ۱۲:۰۰:۰۰
+```
+
+### humanize()
+
+This method returns a string that displays the difference between the current date/time and the instance in a human-readable format that is geared towards being easily understood. It can create strings like '3 hours ago', 'in 1 month', etc.:
+
+```php
+humanize(); // 1 year ago
+```
+
+The exact time displayed is determined in the following manner:
+
+| Time difference | Result |
+|-------------------------------|--------------------------------|
+| 1 year < $time < 2 years | in 1 year / 1 year ago |
+| 1 month < $time < 1 year | in 6 months / 6 months ago |
+| 7 days < $time < 1 month | in 3 weeks / 3 weeks ago |
+| today < $time < 7 days | in 4 days / 4 days ago |
+| $time == yesterday / tomorrow | Yesterday / Tomorrow |
+| 59 minutes < $time < 1 day | in 2 hours / 2 hours ago |
+| now < $time < 1 hour | in 35 minutes / 35 minutes ago |
+| $time == now | Now |
+
+The result strings come from the language file, **system/Language/en/Time.php**. If you want to overwrite them, create **app/Language/{locale}/Time.php**.
+
+## Working with Individual Values
+
+The Time object provides a number of methods that allow you to get and set individual items, like the year, month, hour, etc., of an existing instance. All of the values retrieved through the following methods will be fully localized and respect the locale that the Time instance was created with.
+
+All of the following `getX()` and `setX()` methods can also be used as if they were class properties. So, methods like `getYear()` can also be accessed through `$time->year`, and so on.
+
+### Getters
+
+The following basic getters exist:
+
+```php
+getYear(); // '2016'
+echo $time->getMonth(); // '8'
+echo $time->getDay(); // '12'
+echo $time->getHour(); // '16'
+echo $time->getMinute(); // '15'
+echo $time->getSecond(); // '23'
+
+echo $time->year; // '2016'
+echo $time->month; // '8'
+echo $time->day; // '12'
+echo $time->hour; // '16'
+echo $time->minute; // '15'
+echo $time->second; // '23'
+```
+
+In addition to these, a number of methods exist to provide additional information about the date:
+
+```php
+getDayOfWeek(); // '6'
+echo $time->getDayOfYear(); // '225'
+echo $time->getWeekOfMonth(); // '2'
+echo $time->getWeekOfYear(); // '33'
+echo $time->getTimestamp(); // 1471018523 - UNIX timestamp (locale independent)
+echo $time->getQuarter(); // '3'
+
+echo $time->dayOfWeek; // '6'
+echo $time->dayOfYear; // '225'
+echo $time->weekOfMonth; // '2'
+echo $time->weekOfYear; // '33'
+echo $time->timestamp; // 1471018523
+echo $time->quarter; // '3'
+```
+
+#### getAge()
+
+Returns the age, in years, between the Time instance and the current time. Perfect for checking the age of someone based on their birthday:
+
+```php
+getAge(); // 5
+echo $time->age; // 5
+```
+
+#### getDST()
+
+Returns boolean true/false based on whether the Time instance is currently observing Daylight Saving Time:
+
+```php
+getDst(); // false
+echo Time::createFromDate(2012, 9, 1)->dst; // true
+```
+
+#### getLocal()
+
+Returns boolean true if the Time instance is in the same timezone as the application is currently running in:
+
+```php
+getLocal(); // true
+echo Time::now('Europe/London')->local; // false
+```
+
+#### getUtc()
+
+Returns boolean true if the Time instance is in UTC time:
+
+```php
+getUtc(); // false
+echo Time::now('UTC')->utc; // true
+```
+
+#### getTimezone()
+
+Returns a new [DateTimeZone](https://www.php.net/manual/en/class.datetimezone.php) object set to the timezone of the Time instance:
+
+```php
+getTimezone();
+$tz = Time::now()->timezone;
+
+echo $tz->getName();
+echo $tz->getOffset();
+```
+
+#### getTimezoneName()
+
+Returns the full [timezone string](https://www.php.net/manual/en/timezones.php) of the Time instance:
+
+```php
+getTimezoneName(); // America/Chicago
+echo Time::now('Europe/London')->timezoneName; // Europe/London
+```
+
+### Setters
+
+The following basic setters exist. If any of the values set are out of range, an `InvalidArgumentException` will be thrown.
+
+!!! note "Note"
+ All setters will return a new Time instance, leaving the original instance untouched.
+
+!!! note "Note"
+ All setters will throw an InvalidArgumentException if the value is out of range.
+
+```php
+setYear(2017);
+$time = $time->setMonth(4); // April
+$time = $time->setMonth('April');
+$time = $time->setMonth('Feb'); // February
+$time = $time->setDay(25);
+$time = $time->setHour(14); // 2:00 pm
+$time = $time->setMinute(30);
+$time = $time->setSecond(54);
+```
+
+#### setTimezone()
+
+Converts the time from its current timezone into the new one:
+
+```php
+setTimezone('Europe/London'); // Returns new instance converted to new timezone
+
+echo $time->getTimezoneName(); // American/Chicago
+echo $time2->getTimezoneName(); // Europe/London
+
+echo $time->toDateTimeString(); // 2020-05-13 10:00:00
+echo $time2->toDateTimeString(); // 2020-05-13 18:00:00
+```
+
+#### setTimestamp()
+
+Returns a new instance with the date set to the new timestamp:
+
+```php
+setTimestamp(strtotime('April 1, 2017'));
+
+echo $time->toDateTimeString(); // 2017-05-10 00:00:00
+echo $time2->toDateTimeString(); // 2017-04-01 00:00:00
+```
+
+!!! note "Note"
+ Prior to v4.6.0, due to a bug, this method might return an incorrect date/time. See [Upgrading Guide](../installation/upgrade_460.md#timesettimestamp-behavior-fix) for details.
+
+### Modifying the Value
+
+The following methods allow you to modify the date by adding values to or subtracting values from the current Time. This will not modify the existing Time instance, but will return a new instance.
+
+```php
+addSeconds(23);
+$time = $time->addMinutes(15);
+$time = $time->addHours(12);
+$time = $time->addDays(21);
+$time = $time->addMonths(14);
+$time = $time->addCalendarMonths(2);
+$time = $time->addYears(5);
+
+$time = $time->subSeconds(23);
+$time = $time->subMinutes(15);
+$time = $time->subHours(12);
+$time = $time->subDays(21);
+$time = $time->subMonths(14);
+$time = $time->subCalendarMonths(2);
+$time = $time->subYears(5);
+```
+
+#### addCalendarMonths() / subCalendarMonths()
+
+Modifies the current Time by adding or subtracting whole calendar months. These methods can be useful if you require that no calendar months be skipped in recurring dates. Refer to the table below for a comparison between `addMonths()` and `addCalendarMonths()` for an initial date of `2025-01-31`.
+
+| $months | addMonths() | addCalendarMonths() |
+|---------|-------------|---------------------|
+| 1 | 2025-03-03 | 2025-02-28 |
+| 2 | 2025-03-31 | 2025-03-31 |
+| 3 | 2025-05-01 | 2025-04-30 |
+| 4 | 2025-05-31 | 2025-05-31 |
+| 5 | 2025-07-01 | 2025-06-30 |
+| 6 | 2025-07-31 | 2025-07-31 |
+
+### Comparing Two Times
+
+The following methods allow you to compare one Time instance with another. All comparisons are first converted to UTC before comparisons are done, to ensure that different timezones respond correctly.
+
+#### equals()
+
+Determines if the datetime passed in is equal to the current instance. Equal in this case means that they represent the same moment in time, and are not required to be in the same timezone, as both times are converted to UTC and compared that way:
+
+```php
+equals($time2); // true
+```
+
+The value being tested against can be a Time instance, a DateTime instance, or a string with the full date time in a manner that a new DateTime instance can understand. When passing a string as the first parameter, you can pass a timezone string in as the second parameter. If no timezone is given, the system default will be used:
+
+```php
+equals('January 11, 2017 03:50:00', 'Europe/London'); // true
+```
+
+#### sameAs()
+
+This is identical to the `equals()` method, except that it only returns true when the date, time, AND timezone are all identical:
+
+```php
+sameAs($time2); // false
+$time2->sameAs('January 10, 2017 21:50:00', 'America/Chicago'); // true
+```
+
+#### isBefore()
+
+Checks if the current instance is before the passed-in time. The comparison is done against the UTC versions of both times:
+
+```php
+isBefore($time2); // true
+$time2->isBefore($time1); // false
+```
+
+The value being tested against can be a Time instance, a DateTime instance, or a string with the full date time in a manner that a new DateTime instance can understand. When passing a string as the first parameter, you can pass a timezone string in as the second parameter. If no timezone is given, the system default will be used:
+
+```php
+isBefore('March 15, 2013', 'America/Chicago'); // false
+```
+
+#### isAfter()
+
+Works exactly the same as `isBefore()`, except that it checks if the time is after the time passed in:
+
+```php
+isAfter($time2); // false
+$time2->isAfter($time1); // true
+```
+
+#### isPast()
+
+!!! success "Available from version 4.7.0"
+
+Determines if the current instance's time is in the past, relative to "now". It returns a boolean true/false:
+
+```php
+isPast(); // true
+```
+
+#### isFuture()
+
+!!! success "Available from version 4.7.0"
+
+Determines if the current instance's time is in the future, relative to "now". It returns a boolean true/false:
+
+```php
+isFuture(); // true
+```
+
+### Viewing Differences
+
+To compare two Times directly, you would use the `difference()` method, which returns a `CodeIgniter\I18n\TimeDifference` instance.
+
+The first parameter is either a Time instance, a DateTime instance, or a string with the date/time. If a string is passed in the first parameter, the second parameter can be a timezone string:
+
+```php
+difference(Time::now());
+$diff = $time->difference(new \DateTime('July 4, 1975', 'America/Chicago'));
+$diff = $time->difference('July 4, 1975 13:32:05', 'America/Chicago');
+```
+
+Once you have the TimeDifference instance, you have several methods you can use to find information about the difference between the two times. The value returned will be negative if it was in the past, or positive if in the future from the original time:
+
+```php
+difference($test);
+
+echo $diff->getYears(); // -7
+echo $diff->getMonths(); // -84
+echo $diff->getWeeks(); // -365
+echo $diff->getDays(); // -2557
+echo $diff->getHours(); // -61368
+echo $diff->getMinutes(); // -3682080
+echo $diff->getSeconds(); // -220924800
+```
+
+!!! note "Note"
+ Prior to v4.4.7, Time always converted the time zones to UTC before comparison. This could lead to unexpected results when the compared period contained a day that differed from 24 hours due to Daylight Saving Time (DST).
+
+ Starting with v4.4.7, when comparing date/times that are in the same time zone, the comparison is performed as is, without conversion to UTC.
+
+ ```php
+ difference($test);
+
+ echo $diff->getDays();
+ // 0 in v4.4.6 or before
+ // 1 in v4.4.7 or later
+ ```
+
+You can use either the `getX()` methods, or access the calculated values as if they were properties:
+
+```php
+years; // -7
+echo $diff->months; // -84
+echo $diff->weeks; // -365
+echo $diff->days; // -2557
+echo $diff->hours; // -61368
+echo $diff->minutes; // -3682080
+echo $diff->seconds; // -220924800
+```
+
+#### humanize()
+
+Much like Time's `humanize()` method, this returns a string that displays the difference between the times in a human-readable format that is geared towards being easily understood. It can create strings like '3 hours ago', 'in 1 month', etc. The biggest difference is in how very recent dates are handled:
+
+```php
+difference($test);
+
+echo $diff->humanize(); // 1 year ago
+```
+
+The exact time displayed is determined in the following manner:
+
+| Time difference | Result |
+|-----------------------------|--------------------------------|
+| 1 year < $time < 2 years | in 1 year / 1 year ago |
+| 1 month < $time < 1 year | in 6 months / 6 months ago |
+| 7 days < $time < 1 month | in 3 weeks / 3 weeks ago |
+| today < $time < 7 days | in 4 days / 4 days ago |
+| 1 hour < $time < 1 day | in 8 hours / 8 hours ago |
+| 1 minute < $time < 1 hour | in 35 minutes / 35 minutes ago |
+| $time < 1 minute | Now |
+
+The result strings come from the language file, **system/Language/en/Time.php**. If you want to overwrite them, create **app/Language/{locale}/Time.php**.
diff --git a/docs/libraries/typography.md b/docs/libraries/typography.md
new file mode 100644
index 000000000000..739a29c2b126
--- /dev/null
+++ b/docs/libraries/typography.md
@@ -0,0 +1,78 @@
+# Typography
+
+The Typography library contains methods that help you format text in semantically relevant ways.
+
+## Loading the Library
+
+Like all services in CodeIgniter, it can be loaded via `Config\Services`, though you usually will not need to load it manually:
+
+```php
+autoTypography($string);
+```
+
+!!! note "Note"
+ Typographic formatting can be processor-intensive, particularly if you have a lot of content being formatted. If you choose to use this function, you may want to consider [caching](../general/caching.md) your pages.
+
+#### formatCharacters($str)
+
+- **Parameters**
+ - **$str** `string` Input string
+
+- **Returns**: String with formatted characters.
+
+- **Return type**: `string`
+
+This function mainly converts double and single quotes to curly entities, but it also converts em-dashes, double spaces, and ampersands.
+
+Usage example:
+
+```php
+formatCharacters($string);
+```
+
+#### nl2brExceptPre($str)
+
+- **Parameters**
+ - **$str** `string` Input string
+
+- **Returns**: String with HTML-formatted line breaks
+
+- **Return type**: `string`
+
+Converts newlines to `` tags. This function is identical to the native PHP `nl2br()` function, except that it ignores `` tags.
+
+Usage example:
+
+```php
+nl2brExceptPre($string);
+```
diff --git a/docs/libraries/uploaded_files.md b/docs/libraries/uploaded_files.md
new file mode 100644
index 000000000000..599ba6de3853
--- /dev/null
+++ b/docs/libraries/uploaded_files.md
@@ -0,0 +1,539 @@
+# Working with Uploaded Files
+
+CodeIgniter makes working with files uploaded through a form much simpler and more secure than using PHP's `$_FILES` array directly. The UploadedFile class extends the [File class](files.md) and thus gains all of the features of that class.
+
+!!! note "Note"
+ This is not the same as the File Uploading class in CodeIgniter 3. This provides a raw interface to the uploaded files with a few small features.
+
+## File Upload Form Tutorial
+
+Uploading a file involves the following general process:
+
+- An upload form is displayed, allowing a user to select a file and upload it.
+- When the form is submitted, the file is uploaded to the destination you specify.
+- Along the way, the file is validated to make sure it is allowed to be uploaded based on the preferences you set.
+- Once uploaded, the user will be shown a success message.
+
+To demonstrate this process, here is a brief tutorial. Afterward, you'll find reference information.
+
+### Creating the Upload Form
+
+Using a text editor, create a form called **upload_form.php**. In it, place this code and save it to your **app/Views** directory:
+
+```php
+
+
+
+ Upload Form
+
+
+
+
+ Upload Form
+
+
+
+Your file was successfully uploaded!
+
+
+ name: getBasename()) ?>
+ size: getSizeByBinaryUnit(\CodeIgniter\Files\FileSizeUnit::KB)) ?> KB
+ extension: guessExtension()) ?>
+
+
+
+
+
+
+```
+
+### The Controller
+
+Using a text editor, create a controller called **Upload.php**. In it, place this code and save it to your **app/Controllers** directory:
+
+```php
+ []]);
+ }
+
+ public function upload()
+ {
+ $validationRule = [
+ 'userfile' => [
+ 'label' => 'Image File',
+ 'rules' => [
+ 'uploaded[userfile]',
+ 'is_image[userfile]',
+ 'mime_in[userfile,image/jpg,image/jpeg,image/gif,image/png,image/webp]',
+ 'max_size[userfile,100]',
+ 'max_dims[userfile,1024,768]',
+ ],
+ ],
+ ];
+ if (! $this->validateData([], $validationRule)) {
+ $data = ['errors' => $this->validator->getErrors()];
+
+ return view('upload_form', $data);
+ }
+
+ $img = $this->request->getFile('userfile');
+
+ if (! $img->hasMoved()) {
+ $filepath = WRITEPATH . 'uploads/' . $img->store();
+
+ $data = ['uploaded_fileinfo' => new File($filepath)];
+
+ return view('upload_success', $data);
+ }
+
+ $data = ['errors' => 'The file has already been moved.'];
+
+ return view('upload_form', $data);
+ }
+}
+```
+
+Only the [Rules for File Uploads](validation.md#rules-for-file-uploads) can be used to validate uploaded files.
+
+Therefore, the rule `required` cannot be used either, so if the file is required, use the rule `uploaded` instead.
+
+Note that an empty array (`[]`) is passed as the first argument to `$this->validateData()`. This is because the file validation rules get the data for the uploaded file directly from the Request object.
+
+If the form has fields other than the file upload, pass the field data as the first argument.
+
+### The Routes
+
+Using a text editor, open **app/Config/Routes.php**. In it, add the following two routes:
+
+```php
+get('/', 'Home::index');
+
+$routes->get('upload', 'Upload::index'); // Add this line.
+$routes->post('upload/upload', 'Upload::upload'); // Add this line.
+
+// ...
+```
+
+### The Upload Directory
+
+The uploaded files are stored in the **writable/uploads/** directory.
+
+### Try it!
+
+To try your form, visit your site using a URL similar to this one:
+
+```
+example.com/index.php/upload/
+```
+
+You should see an upload form. Try uploading an image file (either a **jpg**, **gif**, **png**, or **webp**). If the path in your controller is correct, it should work.
+
+## Accessing Files
+
+### All Files
+
+When you upload files, they can be accessed natively in PHP through the `$_FILES` superglobal. This array has some major shortcomings when working with multiple files uploaded at once, and has potential security flaws many developers are not aware of. CodeIgniter helps with both of these situations by standardizing your usage of files behind a common interface.
+
+Files are accessed through the current `IncomingRequest` instance. To retrieve all files that were uploaded with this request, use `getFiles()`. This will return an array of files represented by instances of `CodeIgniter\HTTP\Files\UploadedFile`:
+
+```php
+request->getFiles();
+```
+
+Of course, there are multiple ways to name the file input, and anything but the simplest can create strange results. The array is returned in a manner that you would expect. With the simplest usage, a single file might be submitted like:
+
+```
+My Form
+
+
+
+
+
+
+
+ Username
+ Password
+ Password Confirm
+ Email Address
+
+
+
+
+
+
+```
+
+### The Success Page
+
+Using a text editor, create a form called **success.php**. In it, place this code and save it to your **app/Views/** folder:
+
+```
+
+
+ My Form
+
+
+
+ Your form was successfully submitted!
+
+
+
+
+
+```
+
+### The Controller
+
+Using a text editor, create a controller called **Form.php**. In it, place this code and save it to your **app/Controllers/** folder:
+
+```php
+request->is('post')) {
+ return view('signup');
+ }
+
+ $rules = [
+ // @TODO
+ ];
+
+ $data = $this->request->getPost(array_keys($rules));
+
+ if (! $this->validateData($data, $rules)) {
+ return view('signup');
+ }
+
+ // If you want to get the validated data.
+ $validData = $this->validator->getValidated();
+
+ return view('success');
+ }
+}
+```
+
+!!! note "Note"
+ The [$this->request->is()](../incoming/incomingrequest.md#is) method can be used since v4.3.0. In previous versions, you need to use `if (strtolower($this->request->getMethod()) !== 'post')`.
+
+!!! note "Note"
+ The [$this->validator->getValidated()](#getting-validated-data) method can be used since v4.4.0.
+
+### The Routes
+
+Then add routes for the controller in **app/Config/Routes.php**:
+
+```php
+// ...
+
+$routes->get('form', 'Form::index');
+$routes->post('form', 'Form::index');
+
+// ...
+```
+
+### Try it!
+
+To try your form, visit your site using a URL similar to this one:
+
+```
+example.com/index.php/form/
+```
+
+If you submit the form, you should simply see the form reload. That's because you haven't set up any validation rules in [$this->validateData()](../incoming/controllers.md#this-validatedata) yet.
+
+The `validateData()` method is a method in the Controller. It uses the **Validation class** inside. See [$this->validateData()](../incoming/controllers.md#this-validatedata).
+
+!!! note "Note"
+ Since you haven't told the `validateData()` method to validate anything yet, it **returns false** (boolean false) **by default**. The `validateData()` method only returns true if it has successfully applied your rules without any of them failing.
+
+### Explanation
+
+You'll notice several things about the above pages.
+
+#### signup.php
+
+The form (**signup.php**) is a standard web form with a couple of exceptions:
+
+1. It uses a [form helper](../helpers/form_helper.md) to create the form opening and closing. Technically, this isn't necessary. You could create the form using standard HTML. However, the benefit of using the helper is that it generates the action URL for you, based on the URL in your config file. This makes your application more portable in the event your URLs change.
+
+2. At the top of the form, you'll notice the following function call:
+
+ ```
+
+
+ This function will return any error messages sent back by the validator. If there are no messages, it returns an
+ empty string.
+ ```
+
+#### Form.php
+
+The controller (**Form.php**) has one property: `$helpers`. It loads the form helper used by your view files.
+
+The controller has one method: `index()`. This method returns the **signup** view to show the form when a non-POST request comes. Otherwise, it uses the Controller-provided [$this->validateData()](../incoming/controllers.md#this-validatedata) method. It also runs the validation routine. Based on whether the validation was successful, it either presents the form or the success page.
+
+### Add Validation Rules
+
+Then add validation rules in the controller (**Form.php**):
+
+```php
+// ...
+
+$rules = [
+ 'username' => 'required|max_length[30]',
+ 'password' => 'required|max_length[255]|min_length[10]',
+ 'passconf' => 'required|max_length[255]|matches[password]',
+ 'email' => 'required|max_length[254]|valid_email',
+];
+
+// ...
+```
+
+If you submit the form, you should see the success page or the form with error messages.
+
+## Config for Validation
+
+### Traditional and Strict Rules
+
+CodeIgniter 4 has two kinds of Validation rule classes.
+
+The default rule classes (**Strict Rules**) have the namespace `CodeIgniter\Validation\StrictRules`, and they provide strict validation.
+
+The traditional rule classes (**Traditional Rules**) have the namespace `CodeIgniter\Validation`. They are provided for backward compatibility only. They may not validate non-string values correctly and need not be used in new projects.
+
+!!! note "Note"
+ Since v4.3.0, **Strict Rules** are used by default for better security.
+
+#### Strict Rules
+
+!!! success "Available from version 4.2.0"
+
+The **Strict Rules** don't use implicit type conversion.
+
+#### Traditional Rules
+
+!!! important "Important"
+ Traditional Rules exist only for backward compatibility. Do not use them in new projects. Even if you are already using them, we recommend switching to Strict Rules.
+
+!!! warning "Warning"
+ When validating data that contains non-string values, such as JSON data, you should use **Strict Rules**.
+
+The **Traditional Rules** implicitly assume that string values are validated, and the input value may be converted implicitly to a string value. It works for most basic cases like validating POST data.
+
+However, for example, if you use JSON input data, it may be of type bool/null/array. When you validate the boolean `true`, it is converted to the string `'1'` with the Traditional rule classes. If you validate it with the `integer` rule, `'1'` passes the validation.
+
+#### Using Traditional Rules
+
+!!! warning "Warning"
+ The **Traditional Rules** are provided for backward compatibility only. They may not validate non-string values correctly and need not be used in new projects.
+
+If you want to use traditional rules, you need to change the rule classes in **app/Config/Validation.php**:
+
+```php
+setRule('username', 'Username', 'required|max_length[30]|min_length[3]');
+$validation->setRule('password', 'Password', ['required', 'max_length[255]', 'min_length[8]', 'alpha_numeric_punct']);
+```
+
+The value you pass to `$field` must match the key of any data array that is sent in. If the data is taken directly from `$_POST`, then it must be an exact match for the form input name.
+
+!!! warning "Warning"
+ Prior to v4.2.0, this method's third parameter, `$rules`, was typehinted to accept `string`. In v4.2.0 and after, the typehint was removed to allow arrays, too. To avoid LSP being broken in extending classes overriding this method, the child class's method should also be modified to remove the typehint.
+
+### Setting Multiple Rules
+
+#### setRules()
+
+Like `setRule()`, but accepts an array of field names and their rules:
+
+```php
+$validation->setRules([
+ 'username' => 'required|max_length[30]',
+ 'password' => 'required|max_length[255]|min_length[10]',
+]);
+// or
+$validation->setRules([
+ 'username' => ['required', 'max_length[30]'],
+ 'password' => ['required', 'max_length[255]', 'min_length[10]'],
+]);
+```
+
+To give a labeled error message, you can set it up as follows:
+
+```php
+$validation->setRules([
+ 'username' => ['label' => 'Username', 'rules' => 'required|max_length[30]'],
+ 'password' => ['label' => 'Password', 'rules' => 'required|max_length[255]|min_length[10]'],
+]);
+// or
+$validation->setRules([
+ 'username' => ['label' => 'Username', 'rules' => 'required|max_length[30]'],
+ 'password' => ['label' => 'Password', 'rules' => ['required', 'max_length[255]', 'min_length[10]']],
+]);
+```
+
+!!! note "Note"
+ `setRules()` will overwrite any rules that were set previously. To add more than one rule to an existing set of rules, use `setRule()` multiple times.
+
+### Setting Rules for Array Data
+
+If your data is in a nested associative array, you can use "dot array syntax" to easily validate your data:
+
+```php
+/*
+ * The data to test:
+ * [
+ * 'contacts' => [
+ * 'name' => 'Joe Smith',
+ * 'friends' => [
+ * [
+ * 'name' => 'Fred Flinstone',
+ * ],
+ * [
+ * 'name' => 'Wilma',
+ * ],
+ * ]
+ * ]
+ * ]
+ */
+
+// Joe Smith
+$validation->setRules([
+ 'contacts.name' => 'required|max_length[60]',
+]);
+```
+
+You can use the `*` wildcard symbol to match any one level of the array:
+
+```php
+// Fred Flintsone & Wilma
+$validation->setRules([
+ 'contacts.friends.*.name' => 'required|max_length[60]',
+]);
+```
+
+!!! note "Note"
+ Prior to v4.4.4, due to a bug, the wildcard `*` validated data in incorrect dimensions. See [Upgrading](../installation/upgrade_444.md#validation-with-dot-array-syntax) for details.
+
+The "dot array syntax" can also be useful when you have single-dimension array data. For example, data returned by a multi-select dropdown:
+
+```php
+/*
+ * The data to test:
+ * [
+ * 'user_ids' => [
+ * 1,
+ * 2,
+ * 3,
+ * ]
+ * ]
+ */
+
+// Rule
+$validation->setRules([
+ 'user_ids.*' => 'required|max_length[19]',
+]);
+```
+
+### withRequest()
+
+!!! important "Important"
+ This method exists only for backward compatibility. Do not use it in new projects. Even if you are already using it, we recommend that you use another, more appropriate method.
+
+!!! warning "Warning"
+ If you want to validate POST data only, don't use `withRequest()`. This method uses [$request->getVar()](../incoming/incomingrequest.md#getting-data) which returns `$_GET`, `$_POST` or `$_COOKIE` data in that order (depending on **php.ini** [request-order](https://www.php.net/manual/en/ini.core.php#ini.request-order)). Newer values override older values. POST values may be overridden by the cookies if they have the same name.
+
+One of the most common times you will use the validation library is when validating data that was input from an HTTP Request. If desired, you can pass an instance of the current Request object and it will take all of the input data and set it as the data to be validated:
+
+```php
+$validation = service('validation');
+$request = service('request');
+
+if ($validation->withRequest($request)->run()) {
+ // If you use the input data, you should get it from the getValidated() method.
+ // Otherwise you may create a vulnerability.
+ $validData = $validation->getValidated();
+
+ // ...
+}
+```
+
+!!! warning "Warning"
+ When you use this method, you should use the [getValidated()](#getting-validated-data) method to get the validated data. Because this method gets JSON data from [$request->getJSON()](../incoming/incomingrequest.md#getting-json-data) when the request is a JSON request (`Content-Type: application/json`), or gets raw data from [$request->getRawInput()](../incoming/incomingrequest.md#retrieving-raw-data-put-patch-delete) when the request is a PUT, PATCH, or DELETE request and is not an HTML form post (`Content-Type: multipart/form-data`), or gets data from [$request->getVar()](../incoming/incomingrequest.md#getting-data), and an attacker could change what data is validated.
+
+!!! note "Note"
+ The [getValidated()](#getting-validated-data) method can be used since v4.4.0.
+
+## Working with Validation
+
+### Running Validation
+
+The `run()` method runs validation. It has the method signature:
+
+```
+run(?array $data = null, ?string $group = null, ?string $dbGroup = null): bool
+```
+
+The `$data` is an array of data to validate. The optional second parameter `$group` is the [predefined group of rules](#how-to-save-your-rules) to apply. The optional third parameter `$dbGroup` is the database group to use.
+
+This method returns true if the validation is successful.
+
+```php
+if (! $validation->run($data)) {
+ // handle validation errors
+}
+// or
+if (! $validation->run($data, 'signup')) {
+ // handle validation errors
+}
+```
+
+### Running Multiple Validations
+
+!!! note "Note"
+ The `run()` method will not reset the error state. Should a previous run fail, `run()` will always return false and `getErrors()` will return all previous errors until explicitly reset.
+
+If you intend to run multiple validations, for instance on different data sets or with different rules after one another, you might need to call `$validation->reset()` before each run to get rid of errors from the previous run. Be aware that `reset()` will invalidate any data, rule or custom error you previously set, so `setRules()`, `setRuleGroup()` etc. need to be repeated:
+
+```php
+foreach ($userAccounts as $user) {
+ $validation->reset();
+ $validation->setRules($userAccountRules);
+
+ if (! $validation->run($user)) {
+ // handle validation errors
+ }
+}
+```
+
+### Validating 1 Value
+
+The `check()` method validates one value against the rules. The first parameter `$value` is the value to validate. The second parameter `$rule` holds the validation rules. The optional third parameter `$errors` is the custom error message.
+
+```php
+if ($validation->check($value, 'required')) {
+ // $value is valid.
+}
+```
+
+!!! note "Note"
+ Prior to v4.4.0, this method's second parameter, `$rule`, was typehinted to accept `string`. In v4.4.0 and after, the typehint was removed to allow arrays, too.
+
+!!! note "Note"
+ This method calls the `setRule()` method to set the rules internally.
+
+### Getting Validated Data
+
+!!! success "Available from version 4.4.0"
+
+The actual validated data can be retrieved with the `getValidated()` method. This method returns an array of only those elements that have been validated by the validation rules.
+
+```php
+$validation = service('validation');
+$validation->setRules([
+ 'username' => 'required',
+ 'password' => 'required|min_length[10]',
+]);
+
+$data = [
+ 'username' => 'john',
+ 'password' => 'BPi-$Swu7U5lm$dX',
+ 'csrf_token' => '8b9218a55906f9dcc1dc263dce7f005a',
+];
+
+if ($validation->run($data)) {
+ $validatedData = $validation->getValidated();
+ // $validatedData = [
+ // 'username' => 'john',
+ // 'password' => 'BPi-$Swu7U5lm$dX',
+ // ];
+}
+```
+
+```php
+// In Controller.
+
+if (! $this->validateData($data, [
+ 'username' => 'required',
+ 'password' => 'required|min_length[10]',
+])) {
+ // The validation failed.
+ return view('login', [
+ 'errors' => $this->validator->getErrors(),
+ ]);
+}
+
+// The validation was successful.
+
+// Get the validated data.
+$validData = $this->validator->getValidated();
+```
+
+### Saving Sets of Validation Rules to the Config File
+
+A nice feature of the Validation class is that it permits you to store all your validation rules for your entire application in a config file. You organize the rules into "groups". You can specify a different group every time you run the validation.
+
+#### How to Save Your Rules
+
+To store your validation rules, simply create a new public property in the `Config\Validation` class with the name of your group. This element will hold an array with your validation rules. As shown earlier, the validation array will have this prototype:
+
+```php
+ 'required|max_length[30]',
+ 'password' => 'required|max_length[255]',
+ 'pass_confirm' => 'required|max_length[255]|matches[password]',
+ 'email' => 'required|max_length[254]|valid_email',
+ ];
+
+ // ...
+}
+```
+
+#### How to Specify Rule Group
+
+You can specify the group to use when you call the `run()` method:
+
+```php
+$validation->run($data, 'signup');
+```
+
+#### How to Save Error Messages
+
+You can also store custom error messages in this configuration file by naming the property the same as the group, with `_errors` appended. These will automatically be used for any errors when this group is used:
+
+```php
+ 'required|max_length[30]',
+ 'password' => 'required|max_length[255]',
+ 'pass_confirm' => 'required|max_length[255]|matches[password]',
+ 'email' => 'required|max_length[254]|valid_email',
+ ];
+
+ public array $signup_errors = [
+ 'username' => [
+ 'required' => 'You must choose a username.',
+ ],
+ 'email' => [
+ 'valid_email' => 'Please check the Email field. It does not appear to be valid.',
+ ],
+ ];
+
+ // ...
+}
+```
+
+Or pass all settings in an array:
+
+```php
+ [
+ 'rules' => 'required|max_length[30]',
+ 'errors' => [
+ 'required' => 'You must choose a Username.',
+ ],
+ ],
+ 'email' => [
+ 'rules' => 'required|max_length[254]|valid_email',
+ 'errors' => [
+ 'valid_email' => 'Please check the Email field. It does not appear to be valid.',
+ ],
+ ],
+ ];
+
+ // ...
+}
+```
+
+See [Setting Custom Error Messages](#setting-custom-error-messages) for details on the formatting of the array.
+
+#### Getting & Setting Rule Groups
+
+##### Get Rule Group
+
+This method gets a rule group from the validation configuration:
+
+```php
+$validation->getRuleGroup('signup');
+```
+
+##### Set Rule Group
+
+This method sets a rule group from the validation configuration to the validation service:
+
+```php
+$validation->setRuleGroup('signup');
+```
+
+### Validation Placeholders
+
+The Validation class provides a simple method to replace parts of your rules based on data that's being passed into it. This sounds fairly obscure but can be especially handy with the `is_unique` validation rule.
+
+Placeholders are simply the name of the field (or array key) that was passed in as `$data` surrounded by curly brackets. This will be replaced by the **value** of the matched incoming field. An example should clarify this:
+
+```php
+$validation->setRules([
+ 'id' => 'max_length[19]|is_natural_no_zero',
+ 'email' => 'required|max_length[254]|valid_email|is_unique[users.email,id,{id}]',
+]);
+```
+
+!!! warning "Warning"
+ Since v4.3.5, you must set the validation rules for the placeholder field (the `id` field in the sample code above) for security reasons, because attackers can send any data to your application.
+
+This set of rules states that the email address should be unique in the database, except for the row that has an id matching the placeholder's value. Assuming that the form POST data had the following:
+
+```php
+$_POST = [
+ 'id' => 4,
+ 'email' => 'foo@example.com',
+];
+```
+
+then the `{id}` placeholder would be replaced with the number **4**, giving this revised rule:
+
+```php
+$validation->setRules([
+ 'id' => 'max_length[19]|is_natural_no_zero',
+ 'email' => 'required|max_length[254]|valid_email|is_unique[users.email,id,4]',
+]);
+```
+
+So it will ignore the row in the database that has `id=4` when it verifies the email is unique.
+
+!!! note "Note"
+ Since v4.3.5, if the placeholder (`id`) value does not pass the validation, the placeholder would not be replaced.
+
+This can also be used to create more dynamic rules at runtime, as long as you take care that any dynamic keys passed in don't conflict with your form data.
+
+## Working with Errors
+
+The Validation library provides several methods to help you set error messages, provide custom error messages, and retrieve one or more errors to display.
+
+By default, error messages are derived from language strings in **system/Language/en/Validation.php**, where each rule has an entry. In case you want to change a message default, create a file **app/Language/en/Validation.php** (and/or the corresponding folder of the locale you use in place of/besides `en`) and place in it keys and values of those error messages for which you want different defaults.
+
+### Setting Custom Error Messages
+
+Both the `setRule()` and `setRules()` methods can accept an array of custom messages that will be used as errors specific to each field as their last parameter. This allows for a very pleasant experience for the user since the errors are tailored to each instance. If no custom error message is provided, the default value will be used.
+
+There are two ways to provide custom error messages.
+
+As the last parameter:
+
+```php
+$validation->setRules(
+ [
+ 'username' => 'required|max_length[30]|is_unique[users.username]',
+ 'password' => 'required|max_length[254]|min_length[10]',
+ ],
+ [ // Errors
+ 'username' => [
+ 'required' => 'All accounts must have usernames provided',
+ ],
+ 'password' => [
+ 'min_length' => 'Your password is too short. You want to get hacked?',
+ ],
+ ],
+);
+```
+
+Or in a labeled style:
+
+```php
+$validation->setRules([
+ 'username' => [
+ 'label' => 'Username',
+ 'rules' => 'required|max_length[30]|is_unique[users.username]',
+ 'errors' => [
+ 'required' => 'All accounts must have {field} provided',
+ ],
+ ],
+ 'password' => [
+ 'label' => 'Password',
+ 'rules' => 'required|max_length[255]|min_length[10]',
+ 'errors' => [
+ 'min_length' => 'Your {field} is too short. You want to get hacked?',
+ ],
+ ],
+]);
+```
+
+If you'd like to include a field's "human" name, or the optional parameter some rules allow for (such as max_length), or the value that was validated, you can add the `{field}`, `{param}` and `{value}` tags to your message, respectively:
+
+```
+'min_length' => 'Supplied value ({value}) for {field} must have at least {param} characters.'
+```
+
+On a field with the human name Username and a rule of `min_length[6]` with a value of "Pizza", an error would display: "Supplied value (Pizza) for Username must have at least 6 characters."
+
+!!! warning "Warning"
+ If you get the error messages with `getErrors()` or `getError()`, the messages are not HTML-escaped. If you use user input data like `({value})` to make the error message, it might contain HTML tags. If you don't escape the messages before displaying them, XSS attacks are possible.
+
+!!! note "Note"
+ When using label-style error messages, if you pass the second parameter to `setRules()`, it will be overwritten with the value of the first parameter.
+
+### Translation of Messages and Validation Labels
+
+To use translated strings from language files, we can simply use the dot syntax. Let's say we have a file with translations located here: **app/Language/en/Rules.php**. We can simply use the language lines defined in this file, like this:
+
+```php
+$validation->setRules([
+ 'username' => [
+ 'label' => 'Rules.username',
+ 'rules' => 'required|max_length[30]|is_unique[users.username]',
+ 'errors' => [
+ 'required' => 'Rules.username.required',
+ ],
+ ],
+ 'password' => [
+ 'label' => 'Rules.password',
+ 'rules' => 'required|max_length[255]|min_length[10]',
+ 'errors' => [
+ 'min_length' => 'Rules.password.min_length',
+ ],
+ ],
+]);
+```
+
+### Getting All Errors
+
+If you need to retrieve all error messages for failed fields, you can use the `getErrors()` method:
+
+```php
+$errors = $validation->getErrors();
+/*
+ * Produces:
+ * [
+ * 'field1' => 'error message',
+ * 'field2' => 'error message',
+ * ]
+ */
+```
+
+If no errors exist, an empty array will be returned.
+
+When using a wildcard (`*`), the error will point to a specific field, replacing the asterisk with the appropriate key/keys:
+
+```
+// for data
+'contacts' => [
+ 'friends' => [
+ [
+ 'name' => 'Fred Flintstone',
+ ],
+ [
+ 'name' => '',
+ ],
+ ]
+]
+
+// rule
+'contacts.friends.*.name' => 'required'
+
+// error will be
+'contacts.friends.1.name' => 'The contacts.friends.*.name field is required.'
+```
+
+### Getting a Single Error
+
+You can retrieve the error for a single field with the `getError()` method. The only parameter is the field name:
+
+```php
+$error = $validation->getError('username');
+```
+
+If no error exists, an empty string will be returned.
+
+!!! note "Note"
+ When using a wildcard, all found errors that match the mask will be combined into one line separated by the EOL character.
+
+### Check If Error Exists
+
+You can check to see if an error exists with the `hasError()` method. The only parameter is the field name:
+
+```php
+if ($validation->hasError('username')) {
+ echo $validation->getError('username');
+}
+```
+
+When specifying a field with a wildcard, all errors matching the mask will be checked:
+
+```php
+/*
+ * For errors:
+ * [
+ * 'foo.0.bar' => 'Error',
+ * 'foo.baz.bar' => 'Error',
+ * ]
+ */
+
+// returns true
+$validation->hasError('foo.*.bar');
+```
+
+### Redirect and Validation Errors
+
+PHP shares nothing between requests. So when you redirect if a validation fails, there will be no validation errors in the redirected request because the validation has run in the previous request.
+
+In that case, you need to use the Form helper functions `validation_errors()`, `validation_list_errors()` and `validation_show_error()`. These functions check the validation errors that are stored in the session.
+
+To store the validation errors in the session, you need to use `withInput()` with `redirect()`:
+
+```php
+// In Controller.
+if (! $this->validateData($data, $rules)) {
+ return redirect()->back()->withInput();
+}
+```
+
+## Customizing Error Display
+
+When you call `$validation->listErrors()` or `$validation->showError()`, it loads a view file in the background that determines how the errors are displayed. By default, they display with a class of `errors` on the wrapping div. You can easily create new views and use them throughout your application.
+
+### Creating the Views
+
+The first step is to create custom views. These can be placed anywhere that the `view()` method can locate them, which means the standard View directory or any namespaced View folder will work. For example, you could create a new view at **app/Views/\_errors_list.php**:
+
+```php
+
+
+
+```
+
+An array named `$errors` is available within the view that contains a list of the errors, where the key is the name of the field that had the error, and the value is the error message, like this:
+
+```php
+$errors = [
+ 'username' => 'The username field must be unique.',
+ 'email' => 'You must provide a valid email address.',
+];
+```
+
+There are actually two types of views that you can create. The first has an array of all of the errors, and is what we just looked at. The other type is simpler, and only contains a single variable, `$error`, that contains the error message. This is used with the `showError()` method where a field must be specified:
+
+```
+Hi Sally
+
+
+
+ Hi Joe
+
+
+
+ Hi unknown user
+
+
+```
diff --git a/docs/outgoing/api_responses.md b/docs/outgoing/api_responses.md
new file mode 100644
index 000000000000..a6f802a62504
--- /dev/null
+++ b/docs/outgoing/api_responses.md
@@ -0,0 +1,520 @@
+# API Responses
+
+Much of modern PHP development requires building APIs, whether simply to provide data for a JavaScript-heavy single-page application, or as a standalone product. CodeIgniter provides a couple of traits that can be used with any controller to make common response types simple, with no need to remember which HTTP status code should be returned for which response types.
+
+## Response Examples
+
+The following example shows a common usage pattern within your controllers.
+
+```php
+save($this->request->getPost());
+
+ // Respond with 201 status code
+ return $this->respondCreated();
+ }
+}
+```
+
+In this example, an HTTP status code of 201 is returned, with the generic status message, 'Created'. Methods exist for the most common use cases:
+
+```php
+respond($data, 200);
+
+// Generic failure response
+$this->fail($errors, 400);
+
+// Item created response
+$this->respondCreated($data);
+
+// Item successfully deleted
+$this->respondDeleted($data);
+
+// Command executed by no response required
+$this->respondNoContent($message);
+
+// Client isn't authorized
+$this->failUnauthorized($description);
+
+// Forbidden action
+$this->failForbidden($description);
+
+// Resource Not Found
+$this->failNotFound($description);
+
+// Data was not validated
+$this->failValidationErrors($errors);
+
+// Resource already exists
+$this->failResourceExists($description);
+
+// Resource previously deleted
+$this->failResourceGone($description);
+
+// Client made too many requests
+$this->failTooManyRequests($description);
+```
+
+## Handling Response Types
+
+When you pass your data to any of these methods, they will determine the data type to format the results as based on the following criteria:
+
+- The format is determined according to the controller's `$this->format` value. If that is `null`, it will try to negotiate the content type with what the client asked for, defaulting to the first element (JSON by default) in the `$supportedResponseFormats` property within **app/Config/Format.php**.
+- The data will be formatted according to the format. If the format is not JSON and data is a string, it will be treated as HTML to send back to the client.
+
+!!! note "Note"
+ Prior to v4.5.0, due to a bug, if data is a string, it will be treated as HTML even if the format is JSON.
+
+To define the formatter that is used, edit **app/Config/Format.php**. The `$supportedResponseFormats` property contains a list of MIME types that your application can automatically format the response for. By default, the system knows how to format both XML and JSON responses:
+
+```php
+ \CodeIgniter\Format\JSONFormatter::class,
+ 'application/xml' => \CodeIgniter\Format\XMLFormatter::class,
+ ];
+
+ // ...
+}
+```
+
+So, if your request asks for JSON formatted data in an **Accept** header, the data array you pass to any of the `respond*` or `fail*` methods will be formatted by the `CodeIgniter\Format\JSONFormatter` class. The resulting JSON data will be sent back to the client.
+
+## Class Reference
+
+#### setResponseFormat($format)
+
+- **Parameters**
+ - **$format** `string` The type of response to return, either `json` or `xml`
+
+This defines the format to be used when formatting arrays in responses. If you provide a `null` value for `$format`, it will be automatically determined through content negotiation.
+
+```php
+setResponseFormat('json')->respond(['error' => false]);
+```
+
+#### respond($data[, $statusCode = 200[, $message = '']])
+
+- **Parameters**
+ - **$data** `mixed` The data to return to the client. Either string or array.
+ - **$statusCode** `int` The HTTP status code to return. Defaults to 200
+ - **$message** `string` A custom "reason" message to return.
+
+This is the method used by all other methods in this trait to return a response to the client.
+
+The `$data` element can be either a string or an array. By default, a string will be returned as HTML, while an array will be run through json_encode and returned as JSON, unless [Content Negotiation](../incoming/content_negotiation.md) determines it should be returned in a different format.
+
+If a `$message` string is passed, it will be used in place of the standard IANA reason codes for the response status. Not every client will respect the custom codes, though, and will use the IANA standards that match the status code.
+
+!!! note "Note"
+ Since it sets the status code and body on the active Response instance, this should always be the final method in the script execution.
+
+#### fail($messages[, int $status = 400[, string $code = null[, string $message = '']]])
+
+- **Parameters**
+ - **$messages** `mixed` A string or array of strings that contain error messages encountered.
+ - **$status** `int` The HTTP status code to return. Defaults to 400.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: A multi-part response in the client's preferred format.
+
+This is the generic method used to represent a failed response, and is used by all of the other "fail" methods.
+
+The `$messages` element can be either a string or an array of strings.
+
+The `$status` parameter is the HTTP status code that should be returned.
+
+Since many APIs are better served using custom error codes, a custom error code can be passed in the third parameter. If no value is present, it will be the same as `$status`.
+
+If a `$message` string is passed, it will be used in place of the standard IANA reason codes for the response status. Not every client will respect the custom codes, though, and will use the IANA standards that match the status code.
+
+The response is an array with three elements: `status`, `code`, and `messages`.
+
+- The `status` element contains the status code of the error.
+- The `code` element contains a custom, API-specific error code.
+- The `messages` element contains an array of error messages.
+
+Depending on the number of error messages, the response would look something like:
+
+```php
+ 400,
+ 'code' => '321',
+ 'messages' => [
+ 'error' => 'An error occurred',
+ ],
+];
+
+// Example response with multiple error messages per field
+$response = [
+ 'status' => 400,
+ 'code' => '321a',
+ 'messages' => [
+ 'foo' => 'Error message 1',
+ 'bar' => 'Error message 2',
+ ],
+];
+```
+
+#### respondCreated($data = null[, string $message = ''])
+
+- **Parameters**
+ - **$data** `mixed` The data to return to the client. Either string or array.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when a new resource was created, typically 201:
+
+```php
+insert($data);
+
+return $this->respondCreated($user);
+```
+
+#### respondDeleted($data = null[, string $message = ''])
+
+- **Parameters**
+ - **$data** `mixed` The data to return to the client. Either string or array.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when a resource was deleted as the result of this API call, typically 200.
+
+```php
+delete($id);
+
+return $this->respondDeleted(['id' => $id]);
+```
+
+#### respondNoContent(string $message = 'No Content')
+
+- **Parameters**
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when a command was successfully executed by the server but there is no meaningful reply to send back to the client, typically 204.
+
+```php
+respondNoContent();
+```
+
+#### failUnauthorized(string $description = 'Unauthorized'[, string $code = null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when the user either has not been authorized, or has incorrect authorization. Status code is 401.
+
+```php
+failUnauthorized('Invalid Auth token');
+```
+
+#### failForbidden(string $description = 'Forbidden'[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Unlike `failUnauthorized()`, this method should be used when the requested API endpoint is never allowed. Unauthorized implies the client is encouraged to try again with different credentials. Forbidden means the client should not try again because it won't help. Status code is 403.
+
+```php
+failForbidden('Invalid API endpoint.');
+```
+
+#### failNotFound(string $description = 'Not Found'[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when the requested resource cannot be found. Status code is 404.
+
+```php
+failNotFound('User 13 cannot be found.');
+```
+
+#### failValidationErrors($errors[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$errors** `mixed` The error message or array of messages to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when data the client sent did not pass validation rules. Status code is typically 400.
+
+```php
+failValidationErrors($validation->getErrors());
+```
+
+#### failResourceExists(string $description = 'Conflict'[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when the resource the client is trying to create already exists. Status code is typically 409.
+
+```php
+failResourceExists('A user already exists with that email.');
+```
+
+#### failResourceGone(string $description = 'Gone'[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when the requested resource was previously deleted and is no longer available. Status code is typically 410.
+
+```php
+failResourceGone('That user has been previously deleted.');
+```
+
+#### failTooManyRequests(string $description = 'Too Many Requests'[, string $code=null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when the client has called an API endpoint too many times. This might be due to some form of throttling or rate limiting. Status code is typically 429.
+
+```php
+failTooManyRequests('You must wait 15 seconds before making another request.');
+```
+
+#### failServerError(string $description = 'Internal Server Error'[, string $code = null[, string $message = '']])
+
+- **Parameters**
+ - **$description** `string` The error message to show the user.
+ - **$code** `string` A custom, API-specific, error code.
+ - **$message** `string` A custom "reason" message to return.
+
+- **Returns**: The value of the Response object's `send()` method.
+
+Sets the appropriate status code to use when there is a server error.
+
+```php
+failServerError('Server error.');
+```
+
+## Pagination Responses
+
+When returning paginated results from an API endpoint, you can use the `paginate()` method to return the results along with the pagination information. This helps to keep consistent responses across your API, while providing all of the information that clients will need to properly page through the results.
+
+### Example Usage
+
+```php
+where('active', 1);
+
+ return $this->paginate($model, 20);
+ }
+}
+```
+
+A typical response might look like:
+
+```json
+{
+ "data": [
+ {
+ "id": 1,
+ "username": "admin",
+ "email": "admin@example.com"
+ },
+ {
+ "id": 2,
+ "username": "user",
+ "email": "user@example.com"
+ }
+ ],
+ "meta": {
+ "page": 1,
+ "perPage": 20,
+ "total": 2,
+ "totalPages": 1
+ },
+ "links": {
+ "self": "http://example.com/users?page=1",
+ "first": "http://example.com/users?page=1",
+ "last": "http://example.com/users?page=1",
+ "next": null,
+ "prev": null
+ }
+}
+```
+
+The `paginate()` method will always wrap the results in a `data` element, and will also include `meta` and `links` elements to help the client page through the results. If there are no results, the `data` element will be an empty array, and the `meta` and `links` elements will still be present, but with values that indicate no results.
+
+You can also pass it a Builder instance instead of a Model, as long as the Builder is properly configured with the table name and any necessary joins or where clauses.
+
+```php
+table('users')
+ ->where('active', 1);
+
+ return $this->paginate(resource: $builder, perPage: 20);
+ }
+}
+```
+
+## Class Reference
+
+#### paginate(Model|BaseBuilder $resource, int $perPage = 20, ?string $transformWith = null)
+
+- **Parameters**
+ - **$resource** `Model|BaseBuilder` The resource to paginate, either a Model or a Builder instance.
+ - **$perPage** `int` The number of items to return per page.
+ - **$transformWith** `string|null` Optional transformer class name to transform the results.
+
+Generates a paginated response from the given resource. The resource can be either a Model or a Builder instance. The method will automatically determine the current page from the request's query parameters. The response will include the paginated data, along with metadata about the pagination state and links to navigate through the pages.
+
+If you provide a `$transformWith` parameter with a transformer class name, each item in the paginated results will be transformed using that transformer before being returned. This is useful for controlling the structure and content of your API responses. See [API Transformers](api_transformers.md#api-resources) for more information on creating and using transformers.
+
+Example with transformer:
+
+```php
+paginate(resource: $model, perPage: 20, transformWith: UserTransformer::class);
+ }
+}
+```
diff --git a/docs/outgoing/api_transformers.md b/docs/outgoing/api_transformers.md
new file mode 100644
index 000000000000..59dcf75717df
--- /dev/null
+++ b/docs/outgoing/api_transformers.md
@@ -0,0 +1,744 @@
+# API Resources
+
+When building APIs, you often need to transform your data models into a consistent format before sending them to the client. API Resources, implemented through transformers, provide a clean way to convert your entities, arrays, or objects into structured API responses. They help separate your internal data structure from what you expose through your API, making it easier to maintain and evolve your API over time.
+
+## Quick Example
+
+The following example shows a common usage pattern for transformers in your application.
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ 'created_at' => $resource['created_at'],
+ ];
+ }
+}
+
+// In your controller
+$user = model('UserModel')->find(1);
+$transformer = new UserTransformer();
+
+return $this->respond($transformer->transform($user));
+```
+
+In this example, the `UserTransformer` defines which fields from a user entity should be included in the API response. The `transform()` method converts a single resource, while `transformMany()` handles collections of resources.
+
+## Creating a Transformer
+
+To create a transformer, extend the `BaseTransformer` class and implement the `toArray()` method to define your API resource structure. The `toArray()` method receives the resource being transformed as a parameter, allowing you to access and transform its data.
+
+### Basic Transformer
+
+```php
+ $resource['id'],
+ 'username' => $resource['name'], // Renaming the field
+ 'email' => $resource['email'],
+ 'member_since' => date('Y-m-d', strtotime($resource['created_at'])), // Formatting
+ ];
+ }
+}
+```
+
+The `toArray()` method receives the resource (entity, array, or object) as its parameter and defines the structure of your API response. You can include any fields you want from the resource, and you can also rename or transform values as needed.
+
+### Generating Transformer Files
+
+CodeIgniter provides a CLI command to quickly generate transformer skeleton files:
+
+```console
+php spark make:transformer User
+```
+
+This creates a new transformer file at **app/Transformers/User.php** with the basic structure already in place.
+
+#### Command Options
+
+The `make:transformer` command supports several options:
+
+**--suffix**
+Appends "Transformer" to the class name:
+
+```console
+php spark make:transformer User --suffix
+```
+
+Creates **app/Transformers/UserTransformer.php**
+
+**--namespace**
+Specifies a custom root namespace:
+
+```console
+php spark make:transformer User --namespace MyCompany\API
+```
+
+**--force**
+Forces overwriting an existing file:
+
+```console
+php spark make:transformer User --force
+```
+
+#### Subdirectories
+
+You can organize transformers into subdirectories by including the path in the name:
+
+```console
+php spark make:transformer api/v1/User
+```
+
+This creates **app/Transformers/Api/V1/User.php** with the appropriate namespace `App\Transformers\Api\V1`.
+
+### Using Transformers in Controllers
+
+Once you've created a transformer, you can use it in your controllers to transform data before returning it to the client.
+
+```php
+find($id);
+
+ if (! $user) {
+ return $this->failNotFound('User not found');
+ }
+
+ $transformer = new UserTransformer();
+
+ return $this->respond($transformer->transform($user));
+ }
+
+ public function index()
+ {
+ $users = model('UserModel')->findAll();
+
+ $transformer = new UserTransformer();
+
+ return $this->respond($transformer->transformMany($users));
+ }
+}
+```
+
+## Field Filtering
+
+The transformer automatically supports field filtering through the `fields` query parameter of the current URL. This allows API clients to request only the specific fields they need, reducing bandwidth and improving performance.
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ 'created_at' => $resource['created_at'],
+ 'updated_at' => $resource['updated_at'],
+ ];
+ }
+}
+
+// Request: GET /users/1?fields=id,name
+// Response: {"id": 1, "name": "John Doe"}
+```
+
+A request to `/users/1?fields=id,name` would return only:
+
+```json
+{
+ "id": 1,
+ "name": "John Doe"
+}
+```
+
+### Restricting Available Fields
+
+By default, clients can request any field defined in your `toArray()` method. You can restrict which fields are allowed by overriding the `getAllowedFields()` method:
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ 'created_at' => $resource['created_at'],
+ 'updated_at' => $resource['updated_at'],
+ ];
+ }
+
+ protected function getAllowedFields(): ?array
+ {
+ // Only these fields can be requested
+ return ['id', 'name', 'created_at'];
+ }
+}
+```
+
+Now, even if a client requests `/users/1?fields=email`, an `ApiException` will be thrown because `email` is not in the allowed fields list.
+
+## Including Related Resources
+
+Transformers support loading related resources through the `include` query parameter. This follows a common API pattern where clients can specify which relationships they want included. While relationships are the most frequent use case, you can include any additional data you want by defining custom include methods.
+
+### Defining Include Methods
+
+To support including related resources, create methods prefixed with `include` followed by the resource name. Inside these methods, you can access the current resource being transformed via `$this->resource`:
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ ];
+ }
+
+ protected function includePosts(): array
+ {
+ // Use $this->resource to access the current resource being transformed
+ $posts = model('PostModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new PostTransformer())->transformMany($posts);
+ }
+
+ protected function includeComments(): array
+ {
+ $comments = model('CommentModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new CommentTransformer())->transformMany($comments);
+ }
+}
+```
+
+Note how the include methods use `$this->resource['id']` to access the ID of the user being transformed. The `$this->resource` property is automatically set by the transformer when `transform()` is called.
+
+Clients can now request: `/users/1?include=posts,comments`
+
+The response would include:
+
+```json
+{
+ "id": 1,
+ "name": "John Doe",
+ "email": "john@example.com",
+ "posts": [
+ {
+ "id": 1,
+ "title": "First Post"
+ }
+ ],
+ "comments": [
+ {
+ "id": 1,
+ "content": "Great article!"
+ }
+ ]
+}
+```
+
+!!! note "Note"
+ The `fields` and `include` query parameters describe the **root** resource only. Transformers instantiated inside an `include*()` method (such as `PostTransformer` above) are treated as nested resources: when created **without an explicit request** they do **not** inherit the root request's `fields`/`include` state. This prevents the parent's query parameters from leaking into related resources, which could otherwise cause incorrect field filtering or unexpected/recursive includes. If you deliberately pass a request to a nested transformer, that request's scope is honored.
+
+### Restricting Available Includes
+
+Similar to field filtering, you can restrict which relationships can be included by overriding the `getAllowedIncludes()` method:
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ ];
+ }
+
+ protected function getAllowedIncludes(): ?array
+ {
+ // Only these relationships can be included
+ return ['posts', 'comments'];
+ }
+
+ protected function includePosts(): array
+ {
+ $posts = model('PostModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new PostTransformer())->transformMany($posts);
+ }
+
+ protected function includeComments(): array
+ {
+ $comments = model('CommentModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new CommentTransformer())->transformMany($comments);
+ }
+
+ protected function includeOrders(): array
+ {
+ // This method exists but won't be callable from the API
+ // because 'orders' is not in getAllowedIncludes()
+ $orders = model('OrderModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new OrderTransformer())->transformMany($orders);
+ }
+}
+```
+
+If you want to disable all includes, return an empty array:
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ ];
+ }
+
+ protected function getAllowedIncludes(): ?array
+ {
+ // Return empty array to disable all includes
+ return [];
+ }
+}
+```
+
+### Include Validation
+
+The transformer automatically validates that any requested includes have corresponding `include*()` methods defined in your transformer class. If a client requests an include that doesn't exist, an `ApiException` will be thrown.
+
+For example, if a client requests:
+
+```
+GET /api/users?include=invalid
+```
+
+And your transformer doesn't have an `includeInvalid()` method, an exception will be thrown with the message: "Missing include method for: invalid".
+
+This helps catch typos and prevents unexpected behavior.
+
+## Transforming Collections
+
+The `transformMany()` method makes it easy to transform arrays of resources:
+
+```php
+findAll();
+
+ $transformer = new UserTransformer();
+ $data = $transformer->transformMany($users);
+
+ return $this->respond($data);
+ }
+}
+```
+
+The `transformMany()` method applies the same transformation logic to each item in the collection, including any field filtering or includes specified in the request.
+
+## Working with Different Data Types
+
+Transformers can handle various data types, not just entities.
+
+### Transforming Entities
+
+When you pass an `Entity` instance to `transform()`, it automatically calls the entity's `toArray()` method to get the data:
+
+```php
+ 1,
+ 'name' => 'John Doe',
+ 'email' => 'john@example.com',
+]);
+
+$transformer = new UserTransformer();
+$result = $transformer->transform($user);
+```
+
+### Transforming Arrays
+
+You can transform plain arrays as well:
+
+```php
+ 1,
+ 'name' => 'John Doe',
+ 'email' => 'john@example.com',
+];
+
+$transformer = new UserTransformer();
+$result = $transformer->transform($userData);
+```
+
+### Transforming Objects
+
+Any object can be cast to an array and transformed:
+
+```php
+id = 1;
+$user->name = 'John Doe';
+$user->email = 'john@example.com';
+
+$transformer = new UserTransformer();
+$result = $transformer->transform($user);
+```
+
+### Using toArray() Only
+
+If you don't pass a resource to `transform()`, it will use the data from your `toArray()` method:
+
+```php
+ '1.0',
+ 'status' => 'active',
+ 'message' => 'API is running',
+ ];
+ }
+}
+
+// Usage
+$transformer = new StaticDataTransformer();
+$result = $transformer->transform(null); // No resource passed
+```
+
+## Class Reference
+
+## CodeIgniter\API
+
+### BaseTransformer
+
+#### \__construct(?IncomingRequest $request = null)
+
+- **Parameters**
+ - **$request** `IncomingRequest|null` Optional request instance. If not provided, the global request will be used.
+
+Initializes the transformer and extracts the `fields` and `include` query parameters from the request.
+
+!!! note "Note"
+ When no request is explicitly passed, the global request's `fields` and `include` are read **only for the root transformer**. A transformer constructed during a nested transformation (i.e. inside an `include*()` method) without an explicit request still uses the global request object, but does not read `fields`/`include` from it, to avoid leaking the root's scope. Passing an explicit request always applies that request's scope, regardless of nesting.
+
+#### toArray(mixed $resource)
+
+- **Parameters**
+ - **$resource** `mixed` The resource being transformed (Entity, array, object, or null)
+
+- **Returns**: The array representation of the resource
+
+- **Return type**: `array`
+
+This abstract method must be implemented by child classes to define the structure of the API resource. The resource parameter contains the data being transformed. Return an array with the fields you want to include in the API response, accessing data from the `$resource` parameter.
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'price' => $resource['price'],
+ 'in_stock' => $resource['stock_quantity'] > 0,
+ 'description' => $resource['description'],
+ ];
+ }
+}
+```
+
+#### transform($resource = null)
+
+- **Parameters**
+ - **$resource** `mixed` The resource to transform (Entity, array, object, or null)
+
+- **Returns**: The transformed array
+
+- **Return type**: `array`
+
+Transforms the given resource into an array by calling `toArray()` with the resource data. If `$resource` is `null`, passes `null` to `toArray()`. If it's an Entity, extracts its array representation first. Otherwise, casts it to an array.
+
+The resource is also stored in `$this->resource` so include methods can access it.
+
+The method automatically applies field filtering and includes based on query parameters.
+
+```php
+find(1);
+
+$transformer = new UserTransformer();
+
+// Transform an entity
+$result = $transformer->transform($user);
+
+// Transform an array
+$userData = ['id' => 1, 'name' => 'John Doe'];
+$result = $transformer->transform($userData);
+
+// Use toArray() data
+$result = $transformer->transform();
+```
+
+#### transformMany(array $resources)
+
+- **Parameters**
+ - **$resources** `array` The array of resources to transform
+
+- **Returns**: Array of transformed resources
+
+- **Return type**: `array`
+
+Transforms a collection of resources by calling `transform()` on each item. Field filtering and includes are applied consistently to all items.
+
+```php
+findAll();
+
+$transformer = new UserTransformer();
+$results = $transformer->transformMany($users);
+
+// $results is an array of transformed user arrays
+foreach ($results as $user) {
+ // Each $user is the result of calling transform() on an individual user
+}
+```
+
+#### getAllowedFields()
+
+- **Returns**: Array of allowed field names, or `null` to allow all fields
+- **Return type**: `array|null`
+
+Override this method to restrict which fields can be requested via the `fields` query parameter. Return `null` (the default) to allow all fields from `toArray()`. Return an array of field names to create a whitelist of allowed fields.
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ 'created_at' => $resource['created_at'],
+ ];
+ }
+
+ protected function getAllowedFields(): ?array
+ {
+ // Clients can only request id, name, and created_at
+ // Attempting to request 'email' will throw an ApiException
+ return ['id', 'name', 'created_at'];
+ }
+}
+```
+
+#### getAllowedIncludes()
+
+- **Returns**: Array of allowed include names, or `null` to allow all includes
+- **Return type**: `array|null`
+
+Override this method to restrict which related resources can be included via the `include` query parameter. Return `null` (the default) to allow all includes that have corresponding methods. Return an array of include names to create a whitelist. Return an empty array to disable all includes.
+
+```php
+ $resource['id'],
+ 'name' => $resource['name'],
+ 'email' => $resource['email'],
+ ];
+ }
+
+ protected function getAllowedIncludes(): ?array
+ {
+ // Only 'posts' can be included via ?include=posts
+ // Attempting to include 'orders' will throw an ApiException
+ return ['posts'];
+ }
+
+ protected function includePosts(): array
+ {
+ $posts = model('PostModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new PostTransformer())->transformMany($posts);
+ }
+
+ protected function includeOrders(): array
+ {
+ // This method exists but cannot be called via the API
+ $orders = model('OrderModel')->where('user_id', $this->resource['id'])->findAll();
+
+ return (new OrderTransformer())->transformMany($orders);
+ }
+}
+```
+
+## Exception Reference
+
+### ApiException
+
+#### forInvalidFields(string $field)
+
+- **Parameters**
+ - **$field** `string` The invalid field name(s)
+
+- **Returns**: ApiException instance
+
+- **Return type**: `ApiException`
+
+Thrown when a client requests a field via the `fields` query parameter that is not in the allowed fields list.
+
+#### forInvalidIncludes(string $include)
+
+- **Parameters**
+ - **$include** `string` The invalid include name(s)
+
+- **Returns**: ApiException instance
+
+- **Return type**: `ApiException`
+
+Thrown when a client requests an include via the `include` query parameter that is not in the allowed includes list.
+
+#### forMissingInclude(string $include)
+
+- **Parameters**
+ - **$include** `string` The missing include method name
+
+- **Returns**: ApiException instance
+
+- **Return type**: `ApiException`
+
+Thrown when a client requests an include via the `include` query parameter, but the corresponding `include*()` method does not exist in the transformer class. This validation ensures that all requested includes have proper handler methods defined.
diff --git a/docs/outgoing/csp.md b/docs/outgoing/csp.md
new file mode 100644
index 000000000000..42dbd14bc021
--- /dev/null
+++ b/docs/outgoing/csp.md
@@ -0,0 +1,202 @@
+# Content Security Policy
+
+## What is Content Security Policy?
+
+One of the best protections you have against XSS attacks is to implement a Content Security Policy (CSP) on the site. This requires you to specify and authorize each source of content that is included in your site's HTML, including images, stylesheets, JavaScript files, and so on. The browser will reject content from sources that are not explicitly approved. This authorization is defined within the response's `Content-Security-Policy` header and offers various configuration options.
+
+This sounds complex, and on some sites can definitely be challenging. For many simple sites, though, where all content is served by the same domain (e.g., **http://example.com**), it is very simple to integrate.
+
+As this is a complex subject, this user guide will not go over all of the details. For more information, you should visit the following sites:
+
+- [Content Security Policy main site](https://content-security-policy.com/)
+- [W3C Specification](https://www.w3.org/TR/CSP)
+- [Introduction at HTML5Rocks](https://www.html5rocks.com/en/tutorials/security/content-security-policy/)
+- [Article at SitePoint](https://www.sitepoint.com/improving-web-security-with-the-content-security-policy/)
+
+## Turning CSP On
+
+!!! important "Important"
+ The [Debug Toolbar](../testing/debugging.md#the-debug-toolbar) may use Kint, which outputs inline scripts. Therefore, when CSP is turned on, a CSP nonce is automatically output for the Debug Toolbar. However, if you are not using CSP nonces, this will change the CSP header to something you do not intend, and it will behave differently than in production; if you want to verify CSP behavior, turn off the Debug Toolbar.
+
+By default, support for this is off. To enable support in your application, edit the `CSPEnabled` value in **app/Config/App.php**:
+
+```php
+response->getCSP()` in your controllers.
+
+The class holds a number of methods that map pretty clearly to the appropriate header value that you need to set. Examples are shown below, with different combinations of parameters, though all accept either a directive name or an array of them:
+
+```php
+response->getCSP();
+
+// specify the default directive treatment
+$csp->reportOnly(false);
+
+// specify the origin to use if none provided for a directive
+$csp->setDefaultSrc('cdn.example.com');
+
+// specify the URL that "report-only" reports get sent to
+$csp->setReportURI('http://example.com/csp/reports');
+
+// specify that HTTP requests be upgraded to HTTPS
+$csp->upgradeInsecureRequests(true);
+
+// add types or origins to CSP directives
+// assuming that the default treatment is to block rather than just report
+$csp->addBaseURI('example.com', true); // report only
+$csp->addChildSrc('https://youtube.com'); // blocked
+$csp->addConnectSrc('https://*.facebook.com', false); // blocked
+$csp->addFontSrc('fonts.example.com');
+$csp->addFormAction('self');
+$csp->addFrameAncestor('none', true); // report this one
+$csp->addImageSrc('cdn.example.com');
+$csp->addMediaSrc('cdn.example.com');
+$csp->addManifestSrc('cdn.example.com');
+$csp->addObjectSrc('cdn.example.com', false); // reject from here
+$csp->addPluginType('application/pdf', false); // reject this media type
+$csp->addScriptSrc('scripts.example.com', true); // allow but report requests from here
+$csp->addStyleSrc('css.example.com');
+$csp->addSandbox(['allow-forms', 'allow-scripts']);
+
+// the following CSP3 directives are available in v4.7.0 and later
+$csp->addScriptSrcAttr('trusted.com');
+$csp->addScriptSrcElem('trusted.com');
+$csp->addStyleSrcAttr('trusted.com');
+$csp->addStyleSrcElem('trusted.com');
+$csp->addWorkerSrc('workers.example.com');
+```
+
+The first parameter to each of the "add" methods is an appropriate string value, or an array of them.
+
+### Report Only
+
+The `reportOnly()` method allows you to specify the default reporting treatment for subsequent sources, unless overridden.
+
+For instance, you could specify that youtube.com was allowed, and then provide several allowed but reported sources:
+
+```php
+response->getCSP();
+
+$csp->addChildSrc('https://youtube.com'); // allowed
+$csp->reportOnly(true);
+$csp->addChildSrc('https://metube.com'); // allowed but reported
+$csp->addChildSrc('https://ourtube.com', false); // allowed
+```
+
+### Reporting Directives
+
+To specify the URL you want the reports to be sent to, you can use the `setReportURI()` method.
+
+!!! success "Available from version 4.7.0"
+
+CSP Level 3 deprecates the `report-uri` directive in favor of `report-to`. Therefore, you can use the `setReportToEndpoint()` method to set the reporting endpoint for CSP reports. Before adding this directive, make sure the reporting endpoints are already defined using the `addReportingEndpoints()` method.
+
+```php
+response->getCSP();
+
+$csp->setReportURI('https://example.com/csp-reports');
+
+// Starting in v4.7.0, you can use the setReportToEndpoint() method
+// to set the reporting endpoint for CSP reports
+$csp->addReportingEndpoints([
+ 'default' => 'https://example.com/csp-reports',
+ 'reports' => 'https://example.com/other-csp-reports',
+]);
+$csp->setReportToEndpoint('default');
+```
+
+For backward compatibility with browsers that do not support the `report-to` directive, CodeIgniter4 will also set the `report-uri` directive when you use the `setReportToEndpoint()` method.
+
+### Clear Directives
+
+If you want to clear existing CSP directives, you can use the `clearDirective()` method:
+
+```php
+response->getCSP();
+
+$csp->clearDirective('style-src');
+```
+
+## Inline Content
+
+Inline scripts and styles can be injected through user-generated content. To allow only trusted inline content, CSP lets you add a nonce to trusted `
+```
+
+!!! warning "Warning"
+ If an attacker injects a string like `
+
+// Becomes
+
+
+// OR
+
+```
diff --git a/docs/outgoing/index.md b/docs/outgoing/index.md
new file mode 100644
index 000000000000..685d921b5562
--- /dev/null
+++ b/docs/outgoing/index.md
@@ -0,0 +1,17 @@
+# Building Responses
+
+View components are used to build what is returned to the user.
+
+- [Views](views.md)
+- [View Renderer](view_renderer.md)
+- [View Layouts](view_layouts.md)
+- [View Cells](view_cells.md)
+- [View Parser](view_parser.md)
+- [View Decorators](view_decorators.md)
+- [HTML Table Class](table.md)
+- [HTTP Responses](response.md)
+- [API Responses](api_responses.md)
+- [API Resources](api_transformers.md)
+- [Content Security Policy](csp.md)
+- [Localization](localization.md)
+- [Alternate PHP Syntax for View Files](alternative_php.md)
diff --git a/docs/outgoing/localization.md b/docs/outgoing/localization.md
new file mode 100644
index 000000000000..e1380582e2b5
--- /dev/null
+++ b/docs/outgoing/localization.md
@@ -0,0 +1,515 @@
+# Localization
+
+## Working with Locales
+
+CodeIgniter provides several tools to help you localize your application for different languages. While full localization of an application is a complex subject, it's simple to swap out strings in your application with different supported languages.
+
+### Configuring the Locale
+
+#### Setting the Default Locale
+
+Every site will have a default language/locale it operates in. This can be set in **app/Config/App.php**:
+
+```php
+get('{locale}/books', 'App\Books::index');
+```
+
+In this example, if the user tried to visit **http://example.com/fr/books**, then the locale would be set to `fr`, assuming it was configured as a valid locale.
+
+If the value doesn't match a valid locale as defined in `$supportedLocales` in **app/Config/App.php**, the default locale will be used in its place, unless you choose to use only the supported locales defined in the App configuration file:
+
+```php
+$routes->useSupportedLocalesOnly(true);
+```
+
+!!! note "Note"
+ The `useSupportedLocalesOnly()` method can be used since v4.3.0.
+
+### Setting the Current Locale
+
+#### IncomingRequest Locale
+
+If you want to set the locale directly, you may use the `setLocale()` method in the [IncomingRequest Class](../incoming/incomingrequest.md):
+
+```php
+/** @var \CodeIgniter\HTTP\IncomingRequest $request */
+$request->setLocale('ja');
+```
+
+Before setting the locale, you must set valid locales, because any attempt to set a locale that is not valid will result in the [default locale](#setting-the-default-locale) being set.
+
+By default, the valid locales are defined in `Config\App::$supportedLocales` in **app/Config/App.php**:
+
+```php
+setLocale('ja');
+```
+
+### Retrieving the Current Locale
+
+The current locale can always be retrieved from the IncomingRequest object, through the `getLocale()` method. If your controller is extending `CodeIgniter\Controller`, this will be available through `$this->request`:
+
+```php
+request->getLocale();
+ }
+}
+```
+
+Alternatively, you can use the [Services class](../concepts/services.md) to retrieve the current request:
+
+```php
+$locale = service('request')->getLocale();
+```
+
+## Language Localization
+
+### Creating Language Files
+
+Language strings are stored in the **app/Language** directory, with a sub-directory for each supported language (locale):
+
+```
+app/
+ Language/
+ en/
+ App.php
+ fr/
+ App.php
+```
+
+!!! note "Note"
+ The Language Files do not have namespaces.
+
+Languages do not have any specific naming convention that is required. The file should be named logically to describe the type of content it holds. For example, let's say you want to create a file containing error messages. You might name it simply: **Errors.php**.
+
+Within the file, you would return an array, where each element in the array has a language key and can have a string to return:
+
+```php
+ 'The actual message to be shown.',
+];
+```
+
+!!! note "Note"
+ You cannot use dots (`.`) at the beginning and end of language keys.
+
+It also supports nested definitions:
+
+```php
+ [
+ 'nested' => [
+ 'key' => 'The actual message to be shown.',
+ ],
+ ],
+];
+```
+
+```php
+ 'You must submit an email address',
+ 'errorURLMissing' => 'You must submit a URL',
+ 'errorUsernameMissing' => 'You must submit a username',
+ 'nested' => [
+ 'error' => [
+ 'message' => 'A specific error message',
+ ],
+ ],
+];
+```
+
+### Basic Usage
+
+You can use the `lang()` helper function to retrieve text from any of the language files, by passing the filename and the language key as the first parameter, separated by a period (`.`).
+
+For example, to load the `errorEmailMissing` string from the **Errors.php** language file, you would do the following:
+
+```php
+echo lang('Errors.errorEmailMissing');
+```
+
+For nested definitions, you would do the following:
+
+```php
+echo lang('Errors.nested.error.message');
+```
+
+If the requested language key doesn't exist in the file for the current locale (after [Language Fallback](#language-fallback)), the string will be passed back, unchanged. In this example, it would return `Errors.errorEmailMissing` or `Errors.nested.error.message` if it didn't exist.
+
+#### Replacing Parameters
+
+!!! note "Note"
+ The following functions all require the [intl](https://www.php.net/manual/en/book.intl.php) extension to be loaded on your system in order to work. If the extension is not loaded, no replacement will be attempted. A great overview can be found over at [Sitepoint](https://www.sitepoint.com/localization-demystified-understanding-php-intl/).
+
+You can pass an array of values to replace placeholders in the language string as the second parameter to the `lang()` function. This allows for very simple number translations and formatting:
+
+```php
+ 'I have {0, number} apples.',
+ 'men' => 'The top {1, number} men out-performed the remaining {0, number}',
+ 'namedApples' => 'I have {number_apples, number, integer} apples.',
+];
+
+// Displays "I have 3 apples."
+echo lang('Tests.apples', [3]);
+```
+
+The first item in the placeholder corresponds to the index of the item in the array, if it's numerical:
+
+```php
+// Displays "The top 23 men out-performed the remaining 20"
+echo lang('Tests.men', [20, 23]);
+```
+
+You can also use named keys to make it easier to keep things straight, if you'd like:
+
+```php
+// Displays "I have 3 apples."
+echo lang('Tests.namedApples', ['number_apples' => 3]);
+```
+
+Obviously, you can do more than just number replacement. According to the [official ICU docs](https://unicode-org.github.io/icu-docs/apidoc/released/icu4c/classMessageFormat.html#details) for the underlying library, the following types of data can be replaced:
+
+- numbers - integer, currency, percent
+- dates - short, medium, long, full
+- time - short, medium, long, full
+- spellout - spells out numbers (i.e., 34 becomes thirty-four)
+- ordinal
+- duration
+
+Here are a few examples:
+
+```php
+ 'The time is now {0, time, short}.',
+ 'mediumTime' => 'The time is now {0, time, medium}.',
+ 'longTime' => 'The time is now {0, time, long}.',
+ 'fullTime' => 'The time is now {0, time, full}.',
+ 'shortDate' => 'The date is now {0, date, short}.',
+ 'mediumDate' => 'The date is now {0, date, medium}.',
+ 'longDate' => 'The date is now {0, date, long}.',
+ 'fullDate' => 'The date is now {0, date, full}.',
+ 'spelledOut' => '34 is {0, spellout}',
+ 'ordinal' => 'The ordinal is {0, ordinal}',
+ 'duration' => 'It has been {0, duration}',
+];
+
+// Displays "The time is now 11:18 PM"
+echo lang('Tests.shortTime', [time()]);
+// Displays "The time is now 11:18:50 PM"
+echo lang('Tests.mediumTime', [time()]);
+// Displays "The time is now 11:19:09 PM CDT"
+echo lang('Tests.longTime', [time()]);
+// Displays "The time is now 11:19:26 PM Central Daylight Time"
+echo lang('Tests.fullTime', [time()]);
+
+// Displays "The date is now 8/14/16"
+echo lang('Tests.shortDate', [time()]);
+// Displays "The date is now Aug 14, 2016"
+echo lang('Tests.mediumDate', [time()]);
+// Displays "The date is now August 14, 2016"
+echo lang('Tests.longDate', [time()]);
+// Displays "The date is now Sunday, August 14, 2016"
+echo lang('Tests.fullDate', [time()]);
+
+// Displays "34 is thirty-four"
+echo lang('Tests.spelledOut', [34]);
+
+// Displays "It has been 408,676:24:35"
+echo lang('Tests.ordinal', [time()]);
+```
+
+You should be sure to read up on the MessageFormatter class and the underlying ICU formatting to get a better idea of what capabilities it has, like performing conditional replacement, pluralization, and more. Both of the links provided earlier will give you an excellent idea as to the options available.
+
+#### Specifying Locale
+
+To specify a different locale to be used when replacing parameters, you can pass the locale in as the third parameter to the `lang()` function.
+
+```php
+ 7.41], 'en-GB');
+// Displays "$7.41"
+echo lang('{price, number, currency}', ['price' => 7.41], 'en-US');
+```
+
+If you want to change the current locale, see [Language Locale](#language-locale).
+
+#### Nested Arrays
+
+Language files also allow nested arrays to make working with lists, etc. easier.
+
+```php
+ [
+ 'Apples',
+ 'Bananas',
+ 'Grapes',
+ 'Lemons',
+ 'Oranges',
+ 'Strawberries',
+ ],
+];
+
+// Displays "Apples, Bananas, Grapes, Lemons, Oranges, Strawberries"
+echo implode(', ', lang('Fruit.list'));
+```
+
+### Language Fallback
+
+If you have a set of messages for a given locale, for instance **Language/en/App.php**, you can add language variants for that locale, each in its own folder, for instance **Language/en-US/App.php**.
+
+You only need to provide values for those messages that would be localized differently for that locale variant. Any missing message definitions will be automatically pulled from the main locale settings.
+
+It gets better - the localization can fall all the way back to English (**en**), in case new messages are added to the framework and you haven't had a chance to translate them yet for your locale.
+
+So, if you are using the locale `fr-CA`, then a localized message will first be sought in the **Language/fr-CA** directory, then in the **Language/fr** directory, and finally in the **Language/en** directory.
+
+### System Message Translations
+
+We have an "official" set of the system message translations in their [own repository](https://github.com/codeigniter4/translations).
+
+You could download that repository, and copy its **Language** folder into your **app** folder. The incorporated translations will be automatically picked up because the `App` namespace is mapped to your **app** folder.
+
+Alternatively, a better practice would be to run the following command inside your project:
+
+```console
+composer require codeigniter4/translations
+```
+
+The translated messages will be automatically picked up because the translations folders get mapped appropriately.
+
+### Overriding System Message Translations
+
+The framework provides [System Message Translations](#system-message-translations), and packages that you installed may also provide the message translations.
+
+If you want to override some language messages, create language files in the **app/Language** directory. Then, return only the array you want to override in the file.
+
+### Generating Translation Files via Command
+
+!!! success "Available from version 4.5.0"
+
+You can automatically generate and update translation files in your **app** folder. The command will search for uses of the `lang()` function and combine them with the current translation keys in **app/Language**, using the `defaultLocale` locale from `Config\App`. After the operation, you need to translate the language keys yourself. The command can recognize nested keys such as `File.array.nested.text`. Previously saved keys do not change.
+
+!!! note "Note"
+ Keys that `lang()` can already resolve (for example `Errors.*` from **system/Language**) are treated as already translated, so they are neither listed by `--show-new` nor written into **app/Language**.
+
+```console
+php spark lang:find
+```
+
+```php
+ [
+ 'success' => 'Text.info.success',
+ ],
+ 'paragraph' => 'Text.paragraph',
+];
+```
+
+!!! note "Note"
+ When the command scans folders, **app/Language** will be skipped.
+
+The language files generated will most likely not conform to your coding standards. It is recommended to format them. For example, run `vendor/bin/php-cs-fixer fix ./app/Language` if `php-cs-fixer` is installed.
+
+Before updating, it is possible to preview the translations found by the command:
+
+```console
+php spark lang:find --verbose --show-new
+```
+
+The detailed output of `--verbose` also shows a list of invalid keys. For example:
+
+```console
+...
+
+Files found: 10
+New translates found: 30
+Bad translates found: 5
++------------------------+---------------------------------+
+| Bad Key | Filepath |
++------------------------+---------------------------------+
+| ..invalid_nested_key.. | app/Controllers/Translation.php |
+| .invalid_key | app/Controllers/Translation.php |
+| TranslationBad | app/Controllers/Translation.php |
+| TranslationBad. | app/Controllers/Translation.php |
+| TranslationBad... | app/Controllers/Translation.php |
++------------------------+---------------------------------+
+
+All operations done!
+```
+
+For a more accurate search, specify the desired locale or directory to scan.
+
+```console
+php spark lang:find --dir Controllers/Translation --locale en --show-new
+```
+
+Detailed information can be found by running the command:
+
+```console
+php spark lang:find --help
+```
+
+#### Synchronizing Translation Files via Command
+
+!!! success "Available from version 4.6.0"
+
+You may need to create files for another language when you've finished translating for the current language. You can use the spark `lang:find` command to help with this. However, it might not detect all translations, particularly those with dynamically set parameters like `lang('App.status.' . $key, ['payload' => 'John'], 'en')`.
+
+To ensure no translations are missed, it's best to copy the completed language files and translate them manually. This approach preserves any unique keys the command might have overlooked.
+
+All you need to do is execute:
+
+```console
+// Specify the locale for new/updated translations
+php spark lang:sync --target ru
+
+// or set the original locale
+php spark lang:sync --locale en --target ru
+```
+
+As a result, you will receive files with the translation keys. If there were duplicate keys in the target locale, they are saved.
+
+!!! warning "Warning"
+ Non-matching keys in new translations are deleted!
diff --git a/docs/outgoing/response.md b/docs/outgoing/response.md
new file mode 100644
index 000000000000..48e43396a39b
--- /dev/null
+++ b/docs/outgoing/response.md
@@ -0,0 +1,596 @@
+# HTTP Responses
+
+The Response class extends the [HTTP Message Class](../incoming/message.md) with methods appropriate only for a server responding to the client that called it.
+
+## Working with the Response
+
+A Response class is instantiated for you and passed into your controllers. It can be accessed through `$this->response`. It is the same instance that `Services::response()` returns. We call it the global response instance.
+
+Many times you will not need to touch the class directly, since CodeIgniter takes care of sending the headers and the body for you. This is great if the page successfully created the content it was asked to. When things go wrong, or you need to send very specific status codes back, or even take advantage of the powerful HTTP caching, it's there for you.
+
+### Setting the Output
+
+When you need to set the output of the script directly, and not rely on CodeIgniter to automatically get it, you do it manually with the `setBody` method. This is usually used in conjunction with setting the status code of the response:
+
+```php
+response->setStatusCode(404)->setBody($body);
+```
+
+The reason phrase ('OK', 'Created', 'Moved Permanently') will be automatically added, but you can add custom reasons as the second parameter of the `setStatusCode()` method:
+
+```php
+response->setStatusCode(404, 'Nope. Not here.');
+```
+
+You can format an array into either JSON or XML and set the content type header to the appropriate MIME type with the `setJSON()` and `setXML()` methods. Typically, you will send an array of data to be converted:
+
+```php
+ true,
+ 'id' => 123,
+];
+
+return $this->response->setJSON($data);
+
+// or
+return $this->response->setXML($data);
+```
+
+### Setting Headers
+
+#### setHeader()
+
+Often, you will need to set headers for the response. The Response class makes this very simple to do, with the `setHeader()` method.
+
+The first parameter is the name of the header. The second parameter is the value, which can be either a string or an array of values that will be combined correctly when sent to the client.
+
+```php
+response->setHeader('Location', 'http://example.com')
+ ->setHeader('WWW-Authenticate', 'Negotiate');
+```
+
+Using these methods instead of the native PHP functions ensures that no headers are sent prematurely, causing errors, and makes testing possible.
+
+!!! important "Important"
+ Since v4.6.0, if you set a header using PHP's native `header()` function and then use the `Response` class to set the same header, the previous one will be overwritten.
+
+!!! note "Note"
+ This method just sets headers on the response instance. So, if you create and return another response instance (e.g., if you call `redirect()`), the headers set here will not be sent automatically.
+
+#### appendHeader()
+
+If the header exists and can have more than one value, you may use the `appendHeader()` and `prependHeader()` methods to add the value to the end or beginning of the values list, respectively. The first parameter is the name of the header, while the second is the value to append or prepend.
+
+```php
+response->setHeader('Cache-Control', 'no-cache')
+ ->appendHeader('Cache-Control', 'must-revalidate');
+```
+
+#### removeHeader()
+
+Headers can be removed from the response with the `removeHeader()` method, which takes the header name as the only parameter. This is not case-sensitive.
+
+```php
+response->removeHeader('Location');
+```
+
+## Redirect
+
+If you want to create a redirect, use the `redirect()` function.
+
+It returns a `RedirectResponse` instance. It is a different instance from the global response instance that `Services::response()` returns.
+
+!!! warning "Warning"
+ If you set Cookies or Response Headers before you call `redirect()`, they are set on the global response instance, and they are not automatically copied to the `RedirectResponse` instance. To send them, you need to call the `withCookies()` or `withHeaders()` method manually.
+
+!!! important "Important"
+ If you want to redirect, an instance of `RedirectResponse` must be returned in a method of the [Controller](../incoming/controllers.md) or the [Controller Filter](../incoming/filters.md). Note that the `__construct()` or the `initController()` method cannot return any value. If you forget to return `RedirectResponse`, no redirection will occur.
+
+### Redirect to a URI path
+
+When you want to pass a URI path (relative to baseURL), use `redirect()->to()`:
+
+```php
+// Go to specific URI path. "admin/home" is the URI path relative to baseURL.
+return redirect()->to('admin/home');
+```
+
+!!! note "Note"
+ If there is a fragment in your URL that you want to remove, you can use the refresh parameter in the method. For example, `return redirect()->to('admin/home', null, 'refresh');`.
+
+### Redirect to a Defined Route
+
+When you want to pass a [route name](../incoming/routing.md#named-routes) or `Controller::method` for [reverse routing](../incoming/routing.md#reverse-routing), use `redirect()->route()`:
+
+```php
+// Go to a named route. "user_gallery" is the route name, not a URI path.
+return redirect()->route('user_gallery');
+```
+
+An argument passed into the function is treated as a route name or `Controller::method` for reverse routing, not a relative/full URI, the same as when using `redirect()->route()`:
+
+```php
+// Go to a named/reverse-routed URI.
+return redirect('named_route');
+```
+
+### Redirect Back
+
+When you want to redirect back, use `redirect()->back()`:
+
+```php
+// Go back to the previous page.
+return redirect()->back();
+
+// Keep the old input values upon redirect so they can be used by the `old()` function.
+return redirect()->back()->withInput();
+
+// Set a flash message.
+return redirect()->back()->with('foo', 'message');
+```
+
+!!! note "Note"
+ `redirect()->back()` is not the same as the browser "back" button. It takes a visitor to "the last page viewed during the Session" when the Session is available. If the Session hasn't been loaded, or is otherwise unavailable, then a sanitized version of HTTP_REFERER will be used.
+
+### Redirect with Cookies
+
+If you set Cookies before you call `redirect()`, they are set on the global response instance, and they are not automatically copied to the `RedirectResponse` instance.
+
+To send the Cookies, you need to call the `withCookies()` method manually.
+
+```php
+// Copies all cookies from global response instance.
+return redirect()->back()->withCookies();
+```
+
+### Redirect with Headers
+
+If you set Response Headers before you call `redirect()`, they are set on the global response instance, and they are not automatically copied to the `RedirectResponse` instance.
+
+To send the Headers, you need to call the `withHeaders()` method manually.
+
+```php
+// Copies all headers from the global response instance.
+return redirect()->back()->withHeaders();
+```
+
+### Redirect Status Code
+
+The default HTTP status code for GET requests is 302. However, when using HTTP/1.1 or later, 303 is used for POST/PUT/DELETE requests and 307 for all other requests.
+
+You can specify the status code:
+
+```php
+// Redirect to a URI path relative to baseURL with status code 301.
+return redirect()->to('admin/home', 301);
+
+// Redirect to a route with status code 308.
+return redirect()->route('user_gallery', [], 308);
+
+// Redirect back with status code 302.
+return redirect()->back(302);
+```
+
+!!! note "Note"
+ Due to a bug, in v4.3.3 or previous versions, the status code of the actual redirect response might be changed even if a status code was specified. See [ChangeLog v4.3.4](../changelogs/v4.3.4.md#redirect-status-code).
+
+If you don't know the HTTP status codes for redirection, it is recommended to read [Redirections in HTTP](https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections).
+
+## Force File Download
+
+The Response class provides a simple way to send a file to the client, prompting the browser to download the data to your computer. This sets the appropriate headers to make it happen.
+
+The first parameter is the **name you want to give the downloaded file**, and the second parameter is the file data.
+
+If you set the second parameter to null and `$filename` is an existing, readable file path, then its content will be read instead.
+
+If you set the third parameter to boolean true, then the actual file MIME type (based on the filename extension) will be sent, so that if your browser has a handler for that type, it can use it.
+
+Example:
+
+```php
+response->download($name, $data);
+```
+
+If you want to download an existing file from your server, you'll need to pass `null` explicitly for the second parameter:
+
+```php
+response->download('/path/to/photo.jpg', null);
+```
+
+Use the optional `setFileName()` method to change the filename as it is sent to the client's browser:
+
+```php
+response->download('awkwardEncryptedFileName.fakeExt', null)->setFileName('expenses.csv');
+```
+
+!!! note "Note"
+ The response object MUST be returned for the download to be sent to the client. This allows the response to be passed through all **after** filters before being sent to the client.
+
+### Open File in Browser
+
+Some browsers can display files such as PDF. To tell the browser to display the file instead of saving it, call the `DownloadResponse::inline()` method.
+
+```php
+response->download($name, $data)->inline();
+```
+
+## HTTP Caching
+
+Built into the HTTP specification are tools that help the client (often the web browser) cache the results. Used correctly, this can lead to a huge performance boost to your application because it will tell the client that they don't need to contact the server at all since nothing has changed. And you can't get faster than that.
+
+This is handled through the `Cache-Control` and `ETag` headers. This guide is not the proper place for a thorough introduction to the power of all the cache headers, but you can get a good understanding over at [Google Developers](https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching).
+
+By default, all response objects sent through CodeIgniter have HTTP caching turned off. The options and exact circumstances are too varied for us to be able to create a good default other than turning it off. It's simple to set the Cache values to what you need, through the `setCache()` method:
+
+```php
+ 300,
+ 's-maxage' => 900,
+ 'etag' => 'abcde',
+];
+$this->response->setCache($options);
+```
+
+The `$options` array simply takes an array of key/value pairs that are, with a couple of exceptions, assigned to the `Cache-Control` header. You are free to set all of the options exactly as you need for your specific situation. While most of the options are applied to the `Cache-Control` header, it intelligently applies the `etag` and `last-modified` options to their appropriate headers.
+
+## Class Reference
+
+!!! note "Note"
+ In addition to the methods listed here, this class inherits the methods from the [Message Class](../incoming/message.md).
+
+The methods inherited from the Message Class are:
+
+- `CodeIgniter\\HTTP\\Message::getBody`
+- `CodeIgniter\\HTTP\\Message::setBody`
+- `CodeIgniter\\HTTP\\Message::populateHeaders`
+- `CodeIgniter\\HTTP\\Message::headers`
+- `CodeIgniter\\HTTP\\Message::header`
+- `CodeIgniter\\HTTP\\Message::getHeaderLine`
+- `CodeIgniter\\HTTP\\Message::setHeader`
+- `CodeIgniter\\HTTP\\Message::removeHeader`
+- `CodeIgniter\\HTTP\\Message::appendHeader`
+- `CodeIgniter\\HTTP\\Message::getProtocolVersion`
+- `CodeIgniter\\HTTP\\Message::setProtocolVersion`
+
+## CodeIgniter\HTTP
+
+### Response
+
+#### getStatusCode()
+
+- **Returns**: The current HTTP status code for this response
+- **Return type**: `int`
+
+Returns the current status code for this response. If no status code has been set, an `HTTPException` will be thrown:
+
+```php
+getStatusCode();
+```
+
+#### setStatusCode($code[, $reason=''])
+
+- **Parameters**
+ - **$code** `int` The HTTP status code
+ - **$reason** `string` An optional reason phrase.
+
+- **Returns**: The current Response instance
+
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the HTTP status code that should be sent with this response:
+
+```php
+setStatusCode(404);
+```
+
+The reason phrase will be automatically generated based upon the official lists. If you need to set your own for a custom status code, you can pass the reason phrase as the second parameter:
+
+```php
+setStatusCode(230, 'Tardis initiated');
+```
+
+#### getReasonPhrase()
+
+- **Returns**: The current reason phrase.
+- **Return type**: `string`
+
+Returns the current reason phrase for this response. If no status has been set, it will return an empty string:
+
+```php
+getReasonPhrase();
+```
+
+#### setDate($date)
+
+- **Parameters**
+ - **$date** `DateTime` A DateTime instance with the time to set for this response.
+
+- **Returns**: The current response instance.
+
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the date used for this response. The `$date` argument must be an instance of `DateTime`.
+
+#### setContentType($mime[, $charset='UTF-8'])
+
+- **Parameters**
+ - **$mime** `string` The content type this response represents.
+ - **$charset** `string` The character set this response uses.
+
+- **Returns**: The current response instance.
+
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the content type this response represents:
+
+```php
+setContentType('text/plain');
+$response->setContentType('text/html');
+$response->setContentType('application/json');
+```
+
+By default, the method sets the character set to `UTF-8`. If you need to change this, you can pass the character set as the second parameter:
+
+```php
+setContentType('text/plain', 'x-pig-latin');
+```
+
+#### noCache()
+
+- **Returns**: The current response instance.
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the `Cache-Control` header to turn off all HTTP caching. This is the default setting of all response messages:
+
+```php
+noCache();
+/*
+ * Sets the following header:
+ * Cache-Control: no-store, max-age=0, no-cache
+ */
+```
+
+#### setCache($options)
+
+- **Parameters**
+ - **$options** `array` An array of key/value cache control settings
+
+- **Returns**: The current response instance.
+
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the `Cache-Control` headers, including `ETags` and `Last-Modified`. Typical keys are:
+
+- etag
+- last-modified
+- max-age
+- s-maxage
+- private
+- public
+- must-revalidate
+- proxy-revalidate
+- no-transform
+
+When passing the last-modified option, it can be either a date string or a DateTime object.
+
+#### setLastModified($date)
+
+- **Parameters**
+ - **$date** `string|DateTime` The date to set the Last-Modified header to
+
+- **Returns**: The current response instance.
+
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Sets the `Last-Modified` header. The `$date` argument can be either a string or a `DateTime` instance:
+
+```php
+setLastModified(date('D, d M Y H:i:s'));
+$response->setLastModified(\DateTime::createFromFormat('!U', $timestamp));
+```
+
+#### send(): Response
+
+- **Returns**: The current response instance.
+- **Return type**: `CodeIgniter\HTTP\Response`
+
+Tells the response to send everything back to the client. This will first send the headers, followed by the response body. For the main application response, you do not need to call this as it is handled automatically by CodeIgniter.
+
+#### setCookie($name = ''[, $value = ''[, $expire = 0[, $domain = ''[, $path = '/'[, $prefix = ''[, $secure = null[, $httponly = null[, $samesite = null]]]]]]]])
+
+- **Parameters**
+ - **$name** `array|Cookie|string` Cookie name *or* associative array of all of the parameters available to this method *or* an instance of `CodeIgniter\Cookie\Cookie`
+ - **$value** `string` Cookie value
+ - **$expire** `int` Cookie expiration time in seconds. If set to `0` the cookie will only last as long as the browser is open
+ - **$domain** `string` Cookie domain
+ - **$path** `string` Cookie path
+ - **$prefix** `string` Cookie name prefix. If set to `''`, the default value from **app/Config/Cookie.php** will be used
+ - **$secure** `bool|null` Whether to only transfer the cookie through HTTPS. If set to `null`, the default value from **app/Config/Cookie.php** will be used
+ - **$httponly** `bool|null` Whether to only make the cookie accessible for HTTP requests (no JavaScript). If set to `null`, the default value from **app/Config/Cookie.php** will be used
+ - **$samesite** `string|null` The value for the SameSite cookie parameter. If set to `''` or `null`, the default value from **app/Config/Cookie.php** will be used
+
+- **Return type**: `void`
+
+!!! note "Note"
+ Prior to v4.2.7, the default values of `$secure` and `$httponly` were `false` due to a bug, and these values from **app/Config/Cookie.php** were never used.
+
+Sets a cookie containing the values you specify to the Response instance.
+
+There are two ways to pass information to this method so that a cookie can be set: Array Method, and Discrete Parameters:
+
+**Array Method**
+
+Using this method, an associative array is passed as the first parameter:
+
+```php
+ 'The Cookie Name',
+ 'value' => 'The Value',
+ 'expire' => 86500,
+ 'domain' => '.some-domain.com',
+ 'path' => '/',
+ 'prefix' => 'myprefix_',
+ 'secure' => true,
+ 'httponly' => false,
+ 'samesite' => 'Lax',
+];
+
+$response->setCookie($cookie);
+```
+
+Only the `name` and `value` are required. To delete a cookie, set it with the `value` blank.
+
+The `expire` is set in **seconds**, which will be added to the current time. Do not include the time, but rather only the number of seconds from *now* that you wish the cookie to be valid. If the `expire` is set to zero, the cookie will only last as long as the browser is open.
+
+!!! note "Note"
+ However, if the `value` is set to an empty string and the `expire` is set to `0`, the cookie will be deleted.
+
+For site-wide cookies regardless of how your site is requested, add your URL to the `domain` starting with a period, like this: `.your-domain.com`.
+
+The `path` is usually not needed since the method sets a root path.
+
+The `prefix` is only needed if you need to avoid name collisions with other identically named cookies for your server.
+
+The `secure` flag is only needed if you want to make it a secure cookie by setting it to `true`.
+
+The `samesite` value controls how cookies are shared between domains and sub-domains. Allowed values are `'None'`, `'Lax'`, `'Strict'` or a blank string `''`. If set to a blank string, the default SameSite attribute will be set.
+
+**Discrete Parameters**
+
+If you prefer, you can set the cookie by passing data using individual parameters:
+
+```php
+setCookie($name, $value, $expire, $domain, $path, $prefix, $secure, $httponly, $samesite);
+```
+
+#### deleteCookie($name = ''[, $domain = ''[, $path = '/'[, $prefix = '']]])
+
+- **Parameters**
+ - **$name** `mixed` Cookie name or an array of parameters
+ - **$domain** `string` Cookie domain
+ - **$path** `string` Cookie path
+ - **$prefix** `string` Cookie name prefix
+
+- **Return type**: `void`
+
+Deletes an existing cookie.
+
+!!! note "Note"
+ This also just sets a browser cookie for deleting the cookie.
+
+Only the `name` is required.
+
+The `prefix` is only needed if you need to avoid name collisions with other identically named cookies for your server.
+
+Provide a `prefix` if cookies should only be deleted for that subset. Provide a `domain` name if cookies should only be deleted for that domain. Provide a `path` name if cookies should only be deleted for that path.
+
+If any of the optional parameters are empty, then the same-named cookie will be deleted across all that apply.
+
+Example:
+
+```php
+deleteCookie($name);
+```
+
+#### hasCookie($name = ''[, $value = null[, $prefix = '']])
+
+- **Parameters**
+ - **$name** `mixed` Cookie name or an array of parameters
+ - **$value** `string` Cookie value
+ - **$prefix** `string` Cookie name prefix
+
+- **Return type**: `bool`
+
+Checks to see if the Response has a specified cookie or not.
+
+**Notes**
+
+Only the `name` is required. If a `prefix` is specified, it will be prepended to the cookie name.
+
+If no `value` is given, the method just checks for the existence of the named cookie. If a `value` is given, then the method checks that the cookie exists, and that it has the prescribed value.
+
+Example:
+
+```php
+hasCookie($name)) {
+ // ...
+}
+```
+
+#### getCookie($name = ''[, $prefix = ''])
+
+- **Parameters**
+ - **$name** `string` Cookie name
+ - **$prefix** `string` Cookie name prefix
+
+- **Return type**: `Cookie|Cookie[]|null`
+
+Returns the named cookie, if found, or `null`. If no `name` is given, returns the array of `Cookie` objects.
+
+Example:
+
+```php
+getCookie($name);
+```
+
+#### getCookies()
+
+- **Return type**: `Cookie[]`
+
+Returns all cookies currently set within the Response instance. These are any cookies that you have specifically set during the current request only.
diff --git a/docs/outgoing/table.md b/docs/outgoing/table.md
new file mode 100644
index 000000000000..5dd6c505d41a
--- /dev/null
+++ b/docs/outgoing/table.md
@@ -0,0 +1,486 @@
+# HTML Table Class
+
+The Table Class provides methods that enable you to auto-generate HTML tables from arrays or database result sets.
+
+## Using the Table Class
+
+### Initializing the Class
+
+The Table class is not provided as a service, and should be instantiated "normally", for instance:
+
+```php
+generate($data);
+```
+
+Here is an example of a table created from a database query result. The table class will automatically generate the headings based on the field names (or you can set your own headings using the `setHeading()` method described in the class reference below).
+
+```php
+query('SELECT * FROM my_table');
+
+echo $table->generate($query);
+```
+
+Here is an example showing how you might create a table using discrete parameters:
+
+```php
+setHeading('Name', 'Color', 'Size');
+
+$table->addRow('Fred', 'Blue', 'Small');
+$table->addRow('Mary', 'Red', 'Large');
+$table->addRow('John', 'Green', 'Medium');
+
+echo $table->generate();
+```
+
+Here is the same example, except instead of individual parameters, arrays are used:
+
+```php
+setHeading(['Name', 'Color', 'Size']);
+
+$table->addRow(['Fred', 'Blue', 'Small']);
+$table->addRow(['Mary', 'Red', 'Large']);
+$table->addRow(['John', 'Green', 'Medium']);
+
+echo $table->generate();
+```
+
+### Changing the Look of Your Table
+
+The Table Class permits you to set a table template with which you can specify the design of your layout. Here is the template prototype:
+
+```php
+ '',
+
+ 'thead_open' => '',
+ 'thead_close' => ' ',
+
+ 'heading_row_start' => '',
+ 'heading_row_end' => ' ',
+ 'heading_cell_start' => '',
+ 'heading_cell_end' => ' ',
+
+ 'tfoot_open' => '',
+ 'tfoot_close' => ' ',
+
+ 'footing_row_start' => '',
+ 'footing_row_end' => ' ',
+ 'footing_cell_start' => '',
+ 'footing_cell_end' => ' ',
+
+ 'tbody_open' => '',
+ 'tbody_close' => ' ',
+
+ 'row_start' => '',
+ 'row_end' => ' ',
+ 'cell_start' => '',
+ 'cell_end' => ' ',
+
+ 'row_alt_start' => '',
+ 'row_alt_end' => ' ',
+ 'cell_alt_start' => '',
+ 'cell_alt_end' => ' ',
+
+ 'table_close' => '
',
+];
+
+$table->setTemplate($template);
+```
+
+!!! note "Note"
+ You'll notice there are two sets of "row" blocks in the template. These permit you to create alternating row colors or design elements that alternate with each iteration of the row data.
+
+You are NOT required to submit a complete template. If you only need to change parts of the layout, you can simply submit those elements. In this example, only the table opening tag is being changed:
+
+```php
+ '',
+];
+
+$table->setTemplate($template);
+```
+
+You can also set defaults for these by passing an array of template settings to the Table constructor:
+
+```php
+ '',
+];
+
+$table = new \CodeIgniter\View\Table($customSettings);
+```
+
+### Synchronizing Rows with Headings
+
+!!! success "Available from version 4.4.0"
+
+The `setSyncRowsWithHeading(true)` method ensures that each data value is placed in the same column as defined in `setHeading()` if an associative array was used as a parameter. This is especially useful when dealing with data loaded via REST API where the order is not to your liking, or if the API returned too much data.
+
+If a data row contains a key that is not present in the heading, its value is filtered out. Conversely, if a data row does not have a key listed in the heading, an empty cell will be placed in its place.
+
+```php
+setHeading(['name' => 'Name', 'color' => 'Color', 'size' => 'Size'])
+ ->setSyncRowsWithHeading(true)
+ ->addRow(['color' => 'Blue', 'name' => 'Fred', 'size' => 'Small'])
+ ->addRow(['size' => 'Large', 'age' => '24', 'name' => 'Mary'])
+ ->addRow(['color' => 'Green']);
+
+echo $table->generate();
+?>
+
+
+
+
+
+ Name
+ Color
+ Size
+
+
+
+
+ Fred
+ Blue
+ Small
+
+
+ Mary
+ Large
+
+
+ Green
+
+
+
+```
+
+!!! important "Important"
+ You must call `setSyncRowsWithHeading(true)` and `setHeading([...])` before adding any rows via `addRow([...])` where the rearrangement of columns takes place.
+
+Using an array as input to `generate()` produces the same result:
+
+```php
+ 'Blue',
+ 'name' => 'Fred',
+ 'size' => 'Small',
+ ],
+ [
+ 'size' => 'Large',
+ 'age' => '24',
+ 'name' => 'Mary',
+ ],
+ [
+ 'color' => 'Green',
+ ],
+];
+
+$table = new \CodeIgniter\View\Table();
+
+$table->setHeading(['name' => 'Name', 'color' => 'Color', 'size' => 'Size'])
+ ->setSyncRowsWithHeading(true);
+
+echo $table->generate($data);
+```
+
+## Class Reference
+
+## CodeIgniter\View
+
+### Table
+
+#### $function = null
+
+Allows you to specify a native PHP function or a valid function array object to be applied to all cell data.
+
+```php
+setHeading('Name', 'Color', 'Size');
+$table->addRow('Fred', 'Blue ', 'Small');
+
+$table->function = 'htmlspecialchars';
+echo $table->generate();
+```
+
+In the above example, all cell data would be run through PHP's `htmlspecialchars()` function, resulting in:
+
+```
+Fred <strong>Blue</strong> Small
+```
+
+#### generate([$tableData = null])
+
+- **Parameters**
+ - **$tableData** `mixed` Data to populate the table rows with
+
+- **Returns**: HTML table
+
+- **Return type**: `string`
+
+Returns a string containing the generated table. Accepts an optional parameter which can be an array or a database result object.
+
+#### setCaption($caption)
+
+- **Parameters**
+ - **$caption** `string` Table caption
+
+- **Returns**: Table instance (method chaining)
+
+- **Return type**: `Table`
+
+Permits you to add a caption to the table.
+
+```php
+setCaption('Colors');
+```
+
+#### setHeading([$args = [] [, ...]])
+
+- **Parameters**
+ - **$args** `mixed` An array or multiple strings containing the table column titles
+
+- **Returns**: Table instance (method chaining)
+
+- **Return type**: `Table`
+
+Permits you to set the table heading. You can submit an array or discrete params:
+
+```php
+setHeading('Name', 'Color', 'Size'); // or
+
+$table->setHeading(['Name', 'Color', 'Size']);
+```
+
+#### setFooting([$args = [] [, ...]])
+
+- **Parameters**
+ - **$args** `mixed` An array or multiple strings containing the table footing values
+
+- **Returns**: Table instance (method chaining)
+
+- **Return type**: `Table`
+
+Permits you to set the table footing. You can submit an array or discrete params:
+
+```php
+setFooting('Subtotal', $subtotal, $notes); // or
+
+$table->setFooting(['Subtotal', $subtotal, $notes]);
+```
+
+#### addRow([$args = [] [, ...]])
+
+- **Parameters**
+ - **$args** `mixed` An array or multiple strings containing the row values
+
+- **Returns**: Table instance (method chaining)
+
+- **Return type**: `Table`
+
+Permits you to add a row to your table. You can submit an array or discrete params:
+
+```php
+addRow('Blue', 'Red', 'Green'); // or
+
+$table->addRow(['Blue', 'Red', 'Green']);
+```
+
+If you would like to set an individual cell's tag attributes, you can use an associative array for that cell. The associative key **data** defines the cell's data. Any other key => val pairs are added as key='val' attributes to the tag:
+
+```php
+ 'Blue', 'class' => 'highlight', 'colspan' => 2];
+$table->addRow($cell, 'Red', 'Green');
+
+?>
+
+
+Blue Red Green
+```
+
+#### makeColumns([$array = [] [, $columnLimit = 0]])
+
+- **Parameters**
+ - **$array** `array` An array containing multiple rows' data
+ - **$columnLimit** `int` Count of columns in the table
+
+- **Returns**: An array of HTML table columns
+
+- **Return type**: `array`
+
+This method takes a one-dimensional array as input and creates a multi-dimensional array with a depth equal to the number of columns desired. This allows a single array with many elements to be displayed in a table that has a fixed column count. Consider this example:
+
+```php
+makeColumns($list, 3);
+
+$table->generate($newList);
+
+?>
+
+
+
+
+ one
+ two
+ three
+
+
+ four
+ five
+ six
+
+
+ seven
+ eight
+ nine
+
+
+ ten
+ eleven
+ twelve
+
+
+```
+
+#### setTemplate($template)
+
+- **Parameters**
+ - **$template** `array` An associative array containing template values
+
+- **Returns**: true on success, false on failure
+
+- **Return type**: `bool`
+
+Permits you to set your template. You can submit a full or partial template.
+
+```php
+ '',
+];
+
+$table->setTemplate($template);
+```
+
+#### setEmpty($value)
+
+- **Parameters**
+ - **$value** `mixed` Value to put in empty cells
+
+- **Returns**: Table instance (method chaining)
+
+- **Return type**: `Table`
+
+Lets you set a default value for use in any table cells that are empty. You might, for example, set a non-breaking space:
+
+```php
+setEmpty(' ');
+```
+
+#### clear()
+
+- **Returns**: Table instance (method chaining)
+- **Return type**: `Table`
+
+Lets you clear the table heading, row data and caption. If you need to show multiple tables with different data you should call this method after each table has been generated to clear the previous table information.
+
+Example:
+
+```php
+setCaption('Preferences')
+ ->setHeading('Name', 'Color', 'Size')
+ ->addRow('Fred', 'Blue', 'Small')
+ ->addRow('Mary', 'Red', 'Large')
+ ->addRow('John', 'Green', 'Medium');
+
+echo $table->generate();
+
+$table->clear();
+
+$table->setCaption('Shipping')
+ ->setHeading('Name', 'Day', 'Delivery')
+ ->addRow('Fred', 'Wednesday', 'Express')
+ ->addRow('Mary', 'Monday', 'Air')
+ ->addRow('John', 'Saturday', 'Overnight');
+
+echo $table->generate();
+```
+
+#### setSyncRowsWithHeading(bool $orderByKey)
+
+- **Returns**: Table instance (method chaining)
+- **Return type**: `Table`
+
+Enables each row data key to be ordered by heading keys. This gives more control over data being displayed in the correct column. Make sure to set this value before calling the first `addRow()` method.
diff --git a/docs/outgoing/view_cells.md b/docs/outgoing/view_cells.md
new file mode 100644
index 000000000000..5397f02bc521
--- /dev/null
+++ b/docs/outgoing/view_cells.md
@@ -0,0 +1,383 @@
+# View Cells
+
+Many applications have small view fragments that can be repeated from page to page, or in different places on the pages. These are often help boxes, navigation controls, ads, login forms, etc. CodeIgniter lets you encapsulate the logic for these presentation blocks within View Cells. They are basically mini-views that can be included in other views. They can have logic built in to handle any cell-specific display logic. They can be used to make your views more readable and maintainable by separating the logic for each cell into its own class.
+
+## Simple and Controlled Cells
+
+CodeIgniter supports two types of View Cells: simple and controlled.
+
+**Simple View Cells** can be generated from any class and method of your choice and do not have to follow any rules, except that they must return a string.
+
+**Controlled View Cells** must be generated from a class that extends the `CodeIgniter\View\Cells\Cell` class, which provides additional capabilities that make your View Cells more flexible and faster to use.
+
+## Calling a View Cell
+
+No matter which type of View Cell you are using, you can call it from any view by using the `view_cell()` helper function.
+
+The first parameter is (1) *the name of the class and method* (Simple Cell) or (2) *the name of the class and optional method* (Controlled Cell) to call, and the second parameter is an array or string of parameters to pass to the method:
+
+```php
+// In a View.
+
+// Simple Cell
+ 'value1', 'param2' => 'value2']) ?>
+
+// Controlled Cell
+ 'value1', 'param2' => 'value2']) ?>
+```
+
+The string that the Cell returns will be inserted into the view where the `view_cell()` function was called.
+
+### Namespace Omission
+
+!!! success "Available from version 4.3.0"
+
+If you do not include the full namespace for the class, it will assume it can be found in the `App\Cells` namespace. So, the following example would attempt to find the `MyClass` class in **app/Cells/MyClass.php**. If it is not found there, all namespaces will be scanned until it is found, searching within a **Cells** subdirectory of each namespace:
+
+```php
+// In a View.
+ 'value1', 'param2' => 'value2']) ?>
+```
+
+### Passing Parameters as Key/Value String
+
+You can also pass the parameters along as a key/value string:
+
+```php
+// In a View.
+
+```
+
+## Simple Cells
+
+Simple Cells are classes that return a string from the chosen method. An example of a simple Alert Message cell might look like this:
+
+```php
+{$params['message']}";
+ }
+}
+```
+
+You would call it from within a view like this:
+
+```php
+// In a View.
+ 'success', 'message' => 'The user has been updated.']) ?>
+```
+
+Additionally, you can use parameter names that match the parameter variables in the method for better readability. When you use it this way, all of the parameters must always be specified in the view cell call:
+
+```php
+// In a View.
+
+```
+
+```php
+blogModel->where('category', $category)
+ ->orderBy('published_on', 'desc')
+ ->limit($limit)
+ ->get();
+
+ return view('recentPosts', ['posts' => $posts]);
+ }
+}
+```
+
+## Controlled Cells
+
+!!! success "Available from version 4.3.0"
+
+Controlled cells have two primary goals: (1) to make it as fast as possible to build the cell, and (2) to provide additional logic and flexibility to your views, if they need it.
+
+The class must extend `CodeIgniter\View\Cells\Cell`. It should have a view file in the same folder. By convention, the class name should be in PascalCase suffixed with `Cell` and the view should be the snake_cased version of the class name, without the suffix. For example, if you have a `MyCell` class, the view file should be `my.php`.
+
+!!! note "Note"
+ Prior to v4.3.5, the generated view file ended with `_cell.php`. Though v4.3.5 and newer will generate view files without the `_cell` suffix, existing view files will still be located and loaded.
+
+### Creating a Controlled Cell
+
+At the most basic level, all you need to implement within the class are public properties. These properties will be made available to the view file automatically.
+
+Implementing the AlertMessage from above as a Controlled Cell would look like this:
+
+```php
+">
+
+
+```
+
+```php
+// Called in main View:
+
+```
+
+!!! note "Note"
+ If you use typed properties, you must set the initial values:
+
+ ```php
+ view()` instead of the normal `view()` helper function:
+
+```php
+view('my/custom/view', ['extra' => 'data']);
+ }
+}
+```
+
+### Computed Properties
+
+If you need to perform additional logic for one or more properties, you can use computed properties. These require setting the property to either `protected` or `private` and implementing a public method whose name consists of the property name surrounded by `get` and `Property`:
+
+```php
+// In a View. Initialize the protected properties.
+ 'note', 'message' => 'test']) ?>
+```
+
+```php
+computed = sprintf('%s - %s', $this->type, $this->message);
+ }
+
+ public function getComputedProperty(): string
+ {
+ return $this->computed;
+ }
+
+ public function getTypeProperty(): string
+ {
+ return $this->type;
+ }
+
+ public function getMessageProperty(): string
+ {
+ return $this->message;
+ }
+}
+```
+
+```php
+// app/Cells/alert_message.php
+
+
type -
+
message -
+
computed:
+
+
+ linkPost($post) ?>
+
+
+```
+
+### Performing Setup Logic
+
+If you need to perform additional logic before the view is rendered, you can implement a `mount()` method. This method will be called just after the class is instantiated, and can be used to set additional properties or perform other logic:
+
+```php
+posts = model('PostModel')->orderBy('created_at', 'DESC')->findAll(10);
+ }
+}
+```
+
+You can pass additional parameters to the `mount()` method by passing them as an array to the `view_cell()` helper function. Any of the parameters sent that match a parameter name of the `mount()` method will be passed in:
+
+```php
+posts = model('PostModel')
+ ->when(
+ $categoryId,
+ static fn ($query, $categoryId) => $query->where('category_id', $categoryId),
+ )
+ ->orderBy('created_at', 'DESC')
+ ->findAll(10);
+ }
+}
+```
+
+```php
+// Called in main View:
+ 5]) ?>
+```
+
+## Cell Caching
+
+You can cache the results of the view cell call by passing the number of seconds to cache the data for as the third parameter. This will use the currently configured cache engine:
+
+```php
+// Cache the view for 5 minutes
+
+```
+
+You can provide a custom name to use instead of the auto-generated one if you like, by passing the new name as the fourth parameter:
+
+```php
+// Cache the view for 5 minutes
+
+```
diff --git a/docs/outgoing/view_decorators.md b/docs/outgoing/view_decorators.md
new file mode 100644
index 000000000000..7d6061ff3e7c
--- /dev/null
+++ b/docs/outgoing/view_decorators.md
@@ -0,0 +1,54 @@
+# View Decorators
+
+## What are View Decorators?
+
+View Decorators allow your application to modify the HTML output during the rendering process. This happens just before the output is cached, and allows you to apply custom functionality to your views.
+
+You can use View Decorators with [View Renderer](view_renderer.md) or [View Parser](view_parser.md).
+
+## Creating Decorators
+
+### Creating Decorator Class
+
+Creating your own view decorators requires creating a new class that implements `CodeIgniter\View\ViewDecoratorInterface`. This requires a single method that takes the generated HTML string, performs any modifications on it, and returns the resulting HTML.
+
+```php
+
+
+
+ My Layout
+
+
+ renderSection('content') ?>
+
+
+```
+
+The `renderSection()` method has two arguments: `$sectionName` and `$saveData`. `$sectionName` is the name of the section used by any child view to name the content section. If the boolean argument `$saveData` is set to true, the method saves data for subsequent calls. Otherwise, the method cleans the data after displaying the contents.
+
+E.g. **app/Views/welcome_message.php**:
+
+```
+
+
+
+ <?= $this->renderSection('page_title', true) ?>
+
+
+ renderSection('page_title') ?>
+ renderSection('content') ?>
+
+
+```
+
+!!! note "Note"
+ `$saveData` can be used since v4.4.0.
+
+## Using Layouts in Views
+
+Whenever a view wants to be inserted into a layout, it must use the `extend()` method at the top of the file:
+
+```
+extend('default') ?>
+```
+
+The `extend()` method takes the name of any view file that you wish to use. Since they are standard views, they will be located just like a view. By default, it will look in the application's View directory, but will also scan other PSR-4 defined namespaces. You can include a namespace to locate the view in a particular namespace's View directory:
+
+```
+extend('Blog\default') ?>
+```
+
+All content within a view that extends a layout must be included within `section($name)` and `endSection()` method calls. Any content between these calls will be inserted into the layout wherever the `renderSection($name)` call that matches the section name exists.
+
+E.g. **app/Views/some_view.php**:
+
+```
+extend('default') ?>
+
+section('content') ?>
+ Hello World!
+endSection() ?>
+```
+
+The `endSection()` does not need the section name. It automatically knows which one to close.
+
+Sections can contain nested sections:
+
+```
+extend('default') ?>
+
+section('content') ?>
+ Hello World!
+ section('javascript') ?>
+ let a = 'a';
+ endSection() ?>
+endSection() ?>
+```
+
+## Rendering the View
+
+Rendering the view and its layout is done exactly as any other view would be displayed within a controller:
+
+```php
+include()` to include any view partials.
+
+```
+extend('default') ?>
+
+section('content') ?>
+ Hello World!
+
+ include('sidebar') ?>
+endSection() ?>
+```
+
+When calling the `include()` method, you can pass it all of the same options that you can when rendering a normal view, including cache directives, etc.
+
+## Assign Data to Layers
+
+You can pass additional variables to your templates, just like for `view()`. If you don't use the `saveData = false` flag anywhere in the templates, then the data will be inherited for each block.
+
+!!! note "Note"
+ When using a loop, passing new variables is required.
+
+```php
+setVar('title', 'Homepage')->extend('default') ?>
+
+setVar('hideNavbar', true)->section('content') ?>
+ Items List
+
+ setData(['item' => $item])->include('item_card') ?>
+
+endSection() ?>
+```
diff --git a/docs/outgoing/view_parser.md b/docs/outgoing/view_parser.md
new file mode 100644
index 000000000000..20feeb1fe1e7
--- /dev/null
+++ b/docs/outgoing/view_parser.md
@@ -0,0 +1,934 @@
+# View Parser
+
+The View Parser can perform simple text substitution for pseudo-variables contained within your view files. It can parse simple variables or variable tag pairs.
+
+Pseudo-variable names or control constructs are enclosed in braces, like this:
+
+```
+
+
+ {blog_title}
+
+
+ {blog_heading}
+
+ {blog_entries}
+ {title}
+ {body}
+ {/blog_entries}
+
+
+
+```
+
+These variables are not actual PHP variables, but rather plain text representations that allow you to eliminate PHP from your templates (view files).
+
+!!! note "Note"
+ CodeIgniter does **not** require you to use this class since using pure PHP in your view pages (for instance using the [View renderer](view_renderer.md)) lets them run a little faster. However, some developers prefer to use some form of template engine if they work with designers who might find working with PHP confusing.
+
+## Using the View Parser Class
+
+The simplest method to load the parser class is through its service:
+
+```php
+ 'My Blog Title',
+ 'blog_heading' => 'My Blog Heading',
+];
+
+return $parser->setData($data)->render('blog_template');
+```
+
+View parameters are passed to `setData()` as an associative array of data to be replaced in the template.
+
+In the above example, the template would contain two variables: `{blog_title}` and `{blog_heading}`.
+
+The first parameter to `render()` contains the name of the template, where `blog_template` is the name of your view template file.
+
+!!! important "Important"
+ If the file extension is omitted, then the views are expected to end with the .php extension.
+
+### Parser Configuration Options
+
+Several options can be passed to the `render()` or `renderString()` methods.
+
+- `cache` - the time in seconds to save a view's results; ignored for `renderString()`
+- `cache_name` - the ID used to save/retrieve a cached view result; defaults to the viewpath; ignored for `renderString()`
+- `saveData` - true if the view data parameters should be retained for subsequent calls; default is **true**
+- `cascadeData` - true if pseudo-variable settings should be passed on to nested substitutions; default is **true**
+- `restrictConditionals` - true to allow only simple expressions in conditionals; see [Restricting Conditionals](#restricting-conditionals). Defaults to the `Config\View::$restrictParserConditionals` value (**false**)
+
+```php
+render('blog_template', [
+ 'cache' => HOUR,
+ 'cache_name' => 'something_unique',
+]);
+```
+
+## Substitution Variations
+
+There are three types of substitution supported: simple, looping, and nested. Substitutions are performed in the same sequence that pseudo-variables were added.
+
+The **simple substitution** performed by the parser is a one-to-one replacement of pseudo-variables where the corresponding data parameter has either a scalar or string value, as in this example:
+
+```php
+{blog_title} ';
+$data = ['blog_title' => 'My ramblings'];
+
+return $parser->setData($data)->renderString($template);
+// Result: My ramblings
+```
+
+Substitution values are treated as data, not as template code. Any Parser syntax within a value is rendered literally and is not processed by later substitutions. This also applies to values used inside variable pairs - the pairs themselves must be defined in the template.
+
+The `Parser` takes substitution a lot further with "variable pairs", used for nested substitutions or looping, and with some advanced constructs for conditional substitution.
+
+When the parser executes, it will generally:
+
+- handle any conditional substitutions
+- handle any nested/looping substitutions
+- handle the remaining single substitutions
+
+### Loop Substitutions
+
+A loop substitution happens when the value for a pseudo-variable is a sequential array of arrays, like an array of row settings.
+
+The above example code allows simple variables to be replaced. What if you would like an entire block of variables to be repeated, with each iteration containing new values? Consider the template example we showed at the top of the page:
+
+```
+
+
+ {blog_title}
+
+
+ {blog_heading}
+
+ {blog_entries}
+ {title}
+ {body}
+ {/blog_entries}
+
+
+
+```
+
+In the above code you'll notice a pair of variables: `{blog_entries}` data... `{/blog_entries}`. In a case like this, the entire chunk of data between these pairs would be repeated multiple times, corresponding to the number of rows in the "blog_entries" element of the parameters array.
+
+Parsing variable pairs is done using the identical code shown above to parse single variables, except that you will add a multi-dimensional array corresponding to your variable pair data. Consider this example:
+
+```php
+ 'My Blog Title',
+ 'blog_heading' => 'My Blog Heading',
+ 'blog_entries' => [
+ ['title' => 'Title 1', 'body' => 'Body 1'],
+ ['title' => 'Title 2', 'body' => 'Body 2'],
+ ['title' => 'Title 3', 'body' => 'Body 3'],
+ ['title' => 'Title 4', 'body' => 'Body 4'],
+ ['title' => 'Title 5', 'body' => 'Body 5'],
+ ],
+];
+
+return $parser->setData($data)->render('blog_template');
+```
+
+The value for the pseudo-variable `blog_entries` is a sequential array of associative arrays. The outer level does not have keys associated with each of the nested "rows".
+
+If your "pair" data is coming from a database result, which is already a multi-dimensional array, you can simply use the database `getResultArray()` method:
+
+```php
+query('SELECT * FROM blog');
+
+$data = [
+ 'blog_title' => 'My Blog Title',
+ 'blog_heading' => 'My Blog Heading',
+ 'blog_entries' => $query->getResultArray(),
+];
+
+return $parser->setData($data)->render('blog_template');
+```
+
+If the array you are trying to loop over contains objects instead of arrays, the parser will first look for a `toArray()` method on the object. If it exists, that method will be called and the resulting array is then looped over just as described above. If no `toArray()` method exists, the object will be cast as an array. Public properties are available by name, while non-public properties have visibility-specific prefixes in their array keys.
+
+This is especially useful with Entity classes, whose `toArray()` method returns their attributes with any configured casts and data mappings applied.
+
+### Nested Substitutions
+
+A nested substitution happens when the value for a pseudo-variable is an associative array of values, like a record from a database:
+
+```php
+ 'My Blog Title',
+ 'blog_heading' => 'My Blog Heading',
+ 'blog_entries' => [
+ [
+ 'title' => 'Title 1',
+ 'body' => 'Body 1',
+ ],
+ ],
+];
+
+return $parser->setData($data)->render('blog_template');
+```
+
+The value for the pseudo-variable `blog_entries` is an associative array. The key/value pairs defined inside it will be exposed inside the variable pair loop for that variable.
+
+A **blog_template.php** that might work for the above:
+
+```
+{blog_title} - {blog_heading}
+{blog_entries}
+
+{/blog_entries}
+```
+
+If you would like the other pseudo-variables accessible inside the `blog_entries` scope, then make sure that the `cascadeData` option is set to true.
+
+### Comments
+
+You can place comments in your templates that will be ignored and removed during parsing by wrapping the comments in `{# #}` symbols.
+
+```
+{# This comment is removed during parsing. #}
+{blog_entry}
+
+{/blog_entry}
+```
+
+### Cascading Data
+
+With both a nested and a loop substitution, you have the option of cascading data pairs into the inner substitution.
+
+The following example is not impacted by cascading:
+
+```php
+ 'George',
+ 'locations' => [
+ ['city' => 'Red City', 'planet' => 'Mars'],
+ ],
+];
+
+return $parser->setData($data)->renderString($template);
+// Result: George lives in Red City on Mars.
+```
+
+This example gives different results, depending on cascading:
+
+```php
+ 'George',
+ 'locations' => [
+ ['city' => 'Red City', 'planet' => 'Mars'],
+ ],
+];
+
+return $parser->setData($data)->renderString($template, ['cascadeData' => false]);
+// Result: {name} lives in Red City on Mars.
+
+// or
+
+return $parser->setData($data)->renderString($template, ['cascadeData' => true]);
+// Result: George lives in Red City on Mars.
+```
+
+### Preventing Parsing
+
+You can specify portions of the page to not be parsed with the `{noparse}` `{/noparse}` tag pair. Anything in this section will stay exactly as it is, with no variable substitution, looping, etc., happening to the markup between the brackets.
+
+```
+{noparse}
+ Untouched Code
+{/noparse}
+```
+
+### Conditional Logic
+
+The Parser class supports some basic conditionals to handle `if`, `else`, and `elseif` syntax. All `if` blocks must be closed with an `endif` tag:
+
+```
+{if $role=='admin'}
+ Welcome, Admin!
+{endif}
+```
+
+This simple block is converted to the following during parsing:
+
+```php
+
+ Welcome, Admin!
+
+```
+
+All variables used within if statements must have been previously set with the same name. Other than that, it is treated exactly like a standard PHP conditional, and all standard PHP rules would apply here. You can use any of the comparison operators you would normally, like `==`, `===`, `!==`, `<`, `>`, etc.
+
+```
+{if $role=='admin'}
+ Welcome, Admin
+{elseif $role=='moderator'}
+ Welcome, Moderator
+{else}
+ Welcome, User
+{endif}
+```
+
+Values passed through `setData()` can control a conditional in a trusted template:
+
+```php
+setData(['role' => $userData['role']]);
+
+echo $parser->renderString('{if $role === "admin"}Admin{endif}');
+```
+
+The value of `$role` is checked by the condition; it is not parsed as PHP source.
+
+!!! warning "Warning"
+ Conditionals are evaluated as PHP expressions using `eval()`. Anyone who can edit template source can execute PHP code through an `{if ...}` or `{elseif ...}` tag. Escaping literal PHP tags does not make an untrusted template safe to render. If less-trusted users can edit templates, for example email templates composed in your application, enable [restricted conditionals](#restricting-conditionals).
+
+#### Restricting Conditionals
+
+!!! success "Available from version 4.7.5"
+
+Conditionals are not restricted by default. Enable restriction whenever less-trusted users can edit template source. When restricted, a condition may only contain:
+
+- variables, except `$this`
+- string and number literals, and `true`, `false` and `null`
+- the arithmetic operators `+`, `-`, `*`, `/`, `%` and `**`, including unary `+` and `-`
+- the comparison operators `==`, `!=`, `<>`, `===`, `!==`, `<`, `>`, `<=` and `>=`
+- the logical operators `&&`, `||`, `and`, `or` and `!`
+- parentheses for grouping
+
+For example, `{if $vip}`, `{if $role == 'admin'}` and `{if $total > 100 && ($country == 'GB' || !$guest)}` are allowed. Negative numbers and simple arithmetic, such as `{if $balance < -10}` or `{if $total + 5 >= 100}`, are also allowed. Anything else, such as function calls, constants, property or array access, assignment, concatenation and string interpolation, throws a `ViewException` before the template is evaluated.
+
+To restrict conditionals for a single call, pass the `restrictConditionals` option:
+
+```php
+setData(['first_name' => $user->first_name])
+ ->renderString($emailTemplate, ['restrictConditionals' => true]);
+```
+
+To restrict conditionals by default, set `$restrictParserConditionals` to `true` in **app/Config/View.php**:
+
+```php
+render('dashboard', ['restrictConditionals' => false]);
+```
+
+When a plugin or filter renders another template using the same Parser instance, the nested render inherits any active restriction. It cannot disable the outer render's restriction, even with `restrictConditionals` set to `false`. The restriction is restored to its previous state when the render finishes or throws an exception, so it does not affect later independent renders.
+
+!!! note "Note"
+ Restricting conditionals only limits `{if ...}` and `{elseif ...}` tags. Pseudo-variables in less-trusted templates can still reference any view data, and `{! !}` tags output data without escaping. Only pass data the template author is allowed to see.
+
+#### Changing the Conditional Delimiters
+
+If you have JavaScript code like the following in your templates, the Parser raises a syntax error because there are strings that can be interpreted as a conditional:
+
+```
+
+```
+
+In that case, you can change the delimiters for conditionals with the `setConditionalDelimiters()` method to avoid misinterpretations:
+
+```php
+setConditionalDelimiters('{%', '%}');
+```
+
+In this case, you will write the code in your template like this:
+
+```
+{% if $role=='admin' %}
+ Welcome, Admin
+{% else %}
+ Welcome, User
+{% endif %}
+```
+
+### Escaping Data
+
+Variable substitutions without filters are escaped by default to help prevent XSS attacks on your pages. CodeIgniter's `esc()` method supports several contexts, such as `html`, `attr`, and `css`. If no context is specified, the Parser uses `html`. You can specify the context with the `esc` filter:
+
+```
+{ user_styles | esc(css) }
+{ title }
+```
+
+When a substitution uses one or more filters, the Parser does not add an `esc` filter automatically. This also applies when a context is specified with `setData()` or `setVar()`. Add `esc` explicitly when filtering untrusted data. Filters run from left to right, so its position matters:
+
+```
+{ title|capitalize|esc }
+{ body|esc|nl2br }
+```
+
+In the second example, `esc` escapes the input before `nl2br` adds HTML `{menuitems}
+ {title} ';
+
+$data = [
+ 'menuitems' => [
+ ['title' => 'First Link', 'link' => '/first'],
+ ['title' => 'Second Link', 'link' => '/second'],
+ ]
+];
+
+return $parser->setData($data)->renderString($template);
+```
+
+Result:
+
+```
+
+```
+
+An example with the iteration controlled in the controller, using a view fragment:
+
+```php
+{title} ';
+$data1 = [
+ ['title' => 'First Link', 'link' => '/first'],
+ ['title' => 'Second Link', 'link' => '/second'],
+];
+
+foreach ($data1 as $menuItem) {
+ $temp .= $parser->setData($menuItem)->renderString($template1);
+}
+
+$template2 = '';
+$data = [
+ 'menuitems' => $temp,
+];
+
+return $parser->setData($data)->renderString($template2);
+```
+
+Result:
+
+```
+
+```
+
+## Class Reference
+
+## CodeIgniter\View
+
+### Parser
+
+#### render($view[, $options[, $saveData]])
+
+- **Parameters**
+ - **$view** `string` File name of the view source
+ - **$options** `array` Array of options, as key/value pairs
+ - **$saveData** `boolean` If true, will save data for use with any other calls. If false, will clean the data after rendering the view.
+
+- **Returns**: The rendered text for the chosen view
+
+- **Return type**: `string`
+
+Builds the output based upon a file name and any data that has already been set:
+
+```php
+render('myview');
+```
+
+Options supported:
+
+- `cache` - the time in seconds to save a view's results
+- `cache_name` - the ID used to save/retrieve a cached view result; defaults to the viewpath
+- `cascadeData` - true if the data pairs in effect when a nested or loop substitution occurs should be propagated
+- `saveData` - true if the view data parameter should be retained for subsequent calls
+
+Any conditional substitutions are performed first, then remaining substitutions are performed for each data pair.
+
+#### renderString($template[, $options[, $saveData]])
+
+- **Parameters**
+ - **$template** `string` Trusted view source provided as a string
+ - **$options** `array` Array of options, as key/value pairs
+ - **$saveData** `boolean` If true, will save data for use with any other calls. If false, will clean the data after rendering the view.
+
+- **Returns**: The rendered text for the chosen view
+
+- **Return type**: `string`
+
+Builds the output based upon a provided template source and any data that has already been set:
+
+```php
+renderString('');
+```
+
+Never build the template source from user-provided content. Pass it as data through `setData()` instead, or [restrict conditionals](#restricting-conditionals) if users are meant to edit the template:
+
+```php
+renderString('Hello ' . $name);
+
+// Safe: $name is passed as data.
+echo $parser->setData(['name' => $name])->renderString('Hello {name}');
+```
+
+Options supported, and behavior, as above.
+
+#### setData([$data[, $context = null]])
+
+- **Parameters**
+ - **$data** `array` Array of view data strings, as key/value pairs
+ - **$context** `string` The context to use for data escaping.
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Sets several pieces of view data at once:
+
+```php
+setData(['name' => 'George', 'position' => 'Boss']);
+```
+
+Supported escape contexts: html, css, js, url, attr or raw. If 'raw', no escaping will happen.
+
+#### setVar($name[, $value = null[, $context = null]])
+
+- **Parameters**
+ - **$name** `string` Name of the view data variable
+ - **$value** `mixed` The value of this view data
+ - **$context** `string` The context to use for data escaping.
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Sets a single piece of view data:
+
+```php
+setVar('name', 'Joe', 'html');
+```
+
+Supported escape contexts: html, css, js, url, attr or raw. If 'raw', no escaping will happen.
+
+#### setDelimiters($leftDelimiter = '{', $rightDelimiter = '}')
+
+- **Parameters**
+ - **$leftDelimiter** `string` Left delimiter for substitution fields
+ - **$rightDelimiter** `string` Right delimiter for substitution fields
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Override the substitution field delimiters:
+
+```php
+setDelimiters('[', ']');
+```
+
+#### setConditionalDelimiters($leftDelimiter = '{', $rightDelimiter = '}')
+
+- **Parameters**
+ - **$leftDelimiter** `string` Left delimiter for conditionals
+ - **$rightDelimiter** `string` Right delimiter for conditionals
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Override the conditional delimiters:
+
+```php
+setConditionalDelimiters('{%', '%}');
+```
diff --git a/docs/outgoing/view_renderer.md b/docs/outgoing/view_renderer.md
new file mode 100644
index 000000000000..3ea5048be9c7
--- /dev/null
+++ b/docs/outgoing/view_renderer.md
@@ -0,0 +1,185 @@
+# View Renderer
+
+## Using the View Renderer
+
+The `view()` function is a convenience function that grabs an instance of the `renderer` service, sets the data, and renders the view. While this is often exactly what you want, you may find times where you want to work with it more directly. In that case you can access the View service directly:
+
+```php
+$view = service('renderer');
+```
+
+Alternatively, if you are not using the `View` class as your default renderer, you can instantiate it directly:
+
+```php
+$view = new \CodeIgniter\View\View();
+```
+
+!!! important "Important"
+ You should create services only within controllers. If you need access to the View class from a library, you should set that as a dependency in your library's constructor.
+
+Then you can use any of the three standard methods that it provides: `render()`, `setVar()` and `setData()`.
+
+### What It Does
+
+The `View` class processes conventional HTML/PHP scripts stored in the application's view path, after extracting view parameters into PHP variables, accessible inside the scripts. This means that your view parameter names need to be legal PHP variable names.
+
+The View class uses an associative array internally to accumulate view parameters until you call its `render()` method. This means that your parameter (or variable) names need to be unique, or a later variable setting will override an earlier one.
+
+This also impacts escaping parameter values for different contexts inside your script. You will have to give each escaped value a unique parameter name.
+
+No special meaning is attached to parameters whose value is an array. It is up to you to process the array appropriately in your PHP code.
+
+### Setting View Parameters
+
+The `setVar()` method sets a view parameter.
+
+```php
+$view->setVar('name', 'Joe', 'html');
+```
+
+The `setData()` method sets multiple view parameters at once.
+
+```php
+$view->setData(['name' => 'George', 'position' => 'Boss']);
+```
+
+### Method Chaining
+
+The `setVar()` and `setData()` methods are chainable, allowing you to combine a number of different calls together in a chain:
+
+```php
+$view->setVar('one', $one)
+ ->setVar('two', $two)
+ ->render('myView');
+```
+
+### Escaping Data
+
+When you pass data to the `setVar()` and `setData()` functions, you have the option to escape the data to protect against cross-site scripting attacks. As the last parameter in either method, you can pass the desired context to escape the data for. See below for context descriptions.
+
+If you don't want the data to be escaped, you can pass `null` or `'raw'` as the final parameter to each function:
+
+```php
+$view->setVar('one', $one, 'raw');
+```
+
+If you choose not to escape data, or you are passing in an object instance, you can manually escape the data within the view with the `esc()` function. The first parameter is the string to escape. The second parameter is the context to escape the data for (see below):
+
+```
+getStat()) ?>
+```
+
+#### Escaping Contexts
+
+By default, the `esc()` and, in turn, the `setVar()` and `setData()` functions assume that the data you want to escape is intended to be used within standard HTML. However, if the data is intended for use in JavaScript, CSS, or in an href attribute, you would need different escaping rules to be effective. You can pass in the name of the context as the second parameter. Valid contexts are `'html'`, `'js'`, `'css'`, `'url'`, and `'attr'`:
+
+```
+Some Link
+
+
+
+
+```
+
+### View Renderer Options
+
+Several options can be passed to the `render()` or `renderString()` methods:
+
+- `$options`
+ - `cache` - the time in seconds to save a view's results; ignored for `renderString()`.
+ - `cache_name` - the ID used to save/retrieve a cached view result; defaults to the `$viewPath`; ignored for `renderString()`.
+ - `debug` - can be set to false to disable the addition of debug code for the [Debug Toolbar](../testing/debugging.md#the-debug-toolbar).
+- `$saveData` - true if the view data parameters should be retained for subsequent calls.
+
+!!! note "Note"
+ `$saveData` as defined by the interface must be a boolean, but implementing classes (like `View` below) may extend this to include `null` values.
+
+## Class Reference
+
+## CodeIgniter\View
+
+### View
+
+#### render($view[, $options[, $saveData = false]])
+
+- **Parameters**
+ - **$view** `string` File name of the view source
+ - **$options** `array` Array of options, as key/value pairs
+ - **$saveData** `boolean|null` If true, will save data for use with any other calls. If false, will clean the data after rendering the view. If null, uses the config setting.
+
+- **Returns**: The rendered text for the chosen view
+
+- **Return type**: `string`
+
+Builds the output based upon a file name and any data that has already been set:
+
+```php
+echo $view->render('myview');
+```
+
+#### renderString($view[, $options[, $saveData = false]])
+
+- **Parameters**
+ - **$view** `string` Contents of the view to render, executed as PHP code
+ - **$options** `array` Array of options, as key/value pairs
+ - **$saveData** `boolean|null` If true, will save data for use with any other calls. If false, will clean the data after rendering the view. If null, uses the config setting.
+
+- **Returns**: The rendered text for the chosen view
+
+- **Return type**: `string`
+
+Builds the output based upon a view fragment and any data that has already been set:
+
+```php
+echo $view->renderString('My Sharona
');
+```
+
+!!! warning "Warning"
+ `renderString()` executes the given view contents as PHP code, just like a view file. Treat them as trusted code: never pass contents that less-trusted users can edit, even if they are stored in your database. Escaping or validating such contents does not make them safe to execute. Pass user-provided values as view data instead.
+
+#### setData([$data[, $context = null]])
+
+- **Parameters**
+ - **$data** `array` Array of view data strings, as key/value pairs
+ - **$context** `string` The context to use for data escaping.
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Sets several pieces of view data at once:
+
+```php
+$view->setData(['name' => 'George', 'position' => 'Boss']);
+```
+
+Supported escape contexts: `html`, `css`, `js`, `url`, `attr` or `raw`. If `'raw'`, no escaping will happen.
+
+Each call adds to the array of data that the object is accumulating, until the view is rendered.
+
+#### setVar($name[, $value = null[, $context = null]])
+
+- **Parameters**
+ - **$name** `string` Name of the view data variable
+ - **$value** `mixed` The value of this view data
+ - **$context** `string` The context to use for data escaping.
+
+- **Returns**: The Renderer, for method chaining
+
+- **Return type**: `CodeIgniter\View\RendererInterface`
+
+Sets a single piece of view data:
+
+```php
+$view->setVar('name', 'Joe', 'html');
+```
+
+Supported escape contexts: `html`, `css`, `js`, `url`, `attr` or `raw`. If `'raw'`, no escaping will happen.
+
+If you use a view data variable that you have previously used for this object, the new value will replace the existing one.
diff --git a/docs/outgoing/views.md b/docs/outgoing/views.md
new file mode 100644
index 000000000000..8ee71bcfd87b
--- /dev/null
+++ b/docs/outgoing/views.md
@@ -0,0 +1,306 @@
+# Views
+
+A view is simply a web page, or a page fragment, like a header, footer, sidebar, etc. In fact, views can flexibly be embedded within other views (within other views, etc.) if you need this type of hierarchy.
+
+Views are never called directly. They must be loaded by a controller or [view route](../incoming/routing.md#view-routes).
+
+Remember that in an MVC framework, the Controller acts as the traffic cop, so it is responsible for fetching a particular view. If you have not read the [Controllers](../incoming/controllers.md) page, you should do so before continuing.
+
+Using the example controller you created in the controller page, let's add a view to it.
+
+## Creating a View
+
+Using your text editor, create a file called **blog_view.php** and put this in it:
+
+```
+
+
+ My Blog
+
+
+ Welcome to my Blog!
+
+
+```
+
+Then save the file in your **app/Views** directory.
+
+## Displaying a View
+
+To load and display a particular view file, you will use the `view()` function in your controller, as in the following code:
+
+```php
+return view('name');
+```
+
+Where *name* is the name of your view file.
+
+!!! important "Important"
+ If the file extension is omitted, then the views are expected to end with the **.php** extension.
+
+!!! note "Note"
+ The `view()` function uses [View Renderer](view_renderer.md) internally.
+
+Now, create a file called **Blog.php** in the **app/Controllers** directory, and put this in it:
+
+```php
+get('blog', [Blog::class, 'index']);
+```
+
+If you visit your site, you should see your new view. The URL is similar to this:
+
+```
+example.com/index.php/blog/
+```
+
+## Loading Multiple Views
+
+CodeIgniter will intelligently handle multiple calls to `view()` from within a controller. If more than one call happens, they will be appended together.
+
+For example, you may wish to have a header view, a menu view, a content view, and a footer view. That might look something like this:
+
+```php
+ 'Your title',
+ ];
+
+ return view('header')
+ . view('menu')
+ . view('content', $data)
+ . view('footer');
+ }
+}
+```
+
+In the example above, we are using "dynamically added data", which you will see below.
+
+## Storing Views within Sub-directories
+
+Your view files can also be stored within sub-directories if you prefer that type of organization. When doing so, you will need to include the directory name when loading the view. Example:
+
+```php
+return view('directory_name/file_name');
+```
+
+## Namespaced Views
+
+You can store views under a **Views** directory that is namespaced, and load that view as if it were namespaced. While PHP does not support loading non-class files from a namespace, CodeIgniter provides this feature to make it possible to package your views together in a module-like fashion for easy re-use or distribution.
+
+If you have an **example/blog** directory that has a PSR-4 mapping set up in the [Autoloader](../concepts/autoloader.md) living under the namespace `Example\Blog`, you could retrieve view files as if they were namespaced also.
+
+Following this example, you could load the **blog_view.php** file from **example/blog/Views** by prepending the namespace to the view name (specifying the end directory `Views` as in `Example\Blog\Views\` is not required):
+
+```php
+ 60]);
+```
+
+By default, the view will be cached using the same name as the view file itself. You can customize this by passing along `cache_name` and the cache ID you wish to use:
+
+```php
+// Cache the view for 60 seconds
+return view('file_name', $data, ['cache' => 60, 'cache_name' => 'my_cached_view']);
+```
+
+## Adding Dynamic Data to the View
+
+Data is passed from the controller to the view by way of an array in the second parameter of the `view()` function.
+
+Here's an example:
+
+```php
+$data = [
+ 'title' => 'My title',
+ 'heading' => 'My Heading',
+ 'message' => 'My Message',
+];
+
+return view('blog_view', $data);
+```
+
+Let's try it with your controller file. Open it and add this code:
+
+```php
+
+
+ <?= esc($title) ?>
+
+
+