Issue with CI XSS option - Convert html entity string

You should not use XSS on you input process (validating the input, storing it in your db etc), you should use XSS filtering only in your output process for noumerious reasons. This has been discussed noumerious times on the forum

https://www.codeigniter.com/user_guide/l...input.html