CodeIgniter Forums
Questions about xss_clean - Printable Version

+- CodeIgniter Forums (
+-- Forum: Archived Discussions (
+--- Forum: Archived Libraries & Helpers (
+--- Thread: Questions about xss_clean (/showthread.php?tid=44133)

Questions about xss_clean - El Forum - 08-04-2011

Hello ,

I used to use mysql_real_escape_string() to escape input strings in my MySQL queries.

Since I have problems using this function with <textarea>s (because it is escaping new lines and shows \n\r even if my global xss filtering is set to false), I'd like to use the xss_clean function.

But I'd like to know what does xss_clean() really do. Because I tried to echo some xss_cleaned strings and it doesn't seem to do anything. Is it normal ?

Do I have to use it like this : load the security library first and $this->security->xss_clean($str); ?

Thank you.

Questions about xss_clean - El Forum - 08-04-2011

mysql_real_escape_string() is not for xss.

Anyways, try using one of these: (look at the user guide:

Questions about xss_clean - El Forum - 08-05-2011

It seems to work pretty well. Do you advise me to change all mysql_real_escape_string by $this->db->escape() ?

And by the way is there a clean solution to convert \n to new lines in textareas ?

Thanks !