Just wondering. Doesn’t codeigniter does all the sanitation for you? The thing is instead of reading input via
$_POST
you read it via
$this->input->post
Also at
application/config/config.php
set
global_xss_filtering to true and you have pretty much all what you need.

I like to do all of my output escaping in the view (where the output occurs) because different output formats require different escapes. You’ll need htmlentities for a web page, but you don’t want to use htmlentities on a plain text email. If the data is escaped for HTML in the database you’re restricted to using HTML as the output format, or you first need to reverse the htmlentities call, then escape the data for whatever output format you’;re using.

I don’t like magic quotes for the same reason. Magic quotes assumes that the input will be placed into the database and escapes it for that purpose. If the data fails validation and is returned to the html form, you need to strip out the backslashes first, which is a hassle.

I prefer to use “pure” unescaped data throughout my controllers and models, then escape it with the appropriate function just before output (i.e. in a view, or sql statement). I find it less hassle to work that way, otherwise you need to keep track of what form the string is in at any time, which is a pain.

Realistically, in this app, we’ll probably only use the data in a web app, so it wouldn’t be a major inconvenience to have the data html entity encoded in the database itself, but I prefer to retain the flexibility in case I change my mind later.

Hope that helps.

Jim.