I am using a MVC framework and I have developed a module where .csv file is being imported into the database, I am little unsure about certain things which I'll try to explain below:
.csv file is uploaded and I do all the initial checks like valid .csv file, size etc
Next I go through the main headers of the .csv file and check if there are any new fields added to the file and if there are then I create an array of those fields. Before checking I already get list of existing fields from the db as an array. Then I create a string of all table field names, after properly sanitizing and escaping them using php
I go through the .csv file line by line, sanitize & escape values using php and create a string that is used as VALUES for my insert query
I pass the string of fields and values to the model for query execution.
Now thing is I am executing Steps 1 to 3 in controller and Step 4 in model, so question is should I sanitize & escape fields n values in controller or should I do it in the model? Which is technically & logically much better way of doing things in the MVC framework.