Securing my first CI website

[eluser]JoostV[/eluser]
In addition, global_xss_filtering only filters against XSS attacks. There are numerous more vulnerabilities you should guard your app against: CSRF & SQL injection, session hijacking, PHP code inclusion, etc. Not to mention configuration vulnerabilities such as register_globals = on, which is still default on some shared hosts.

Google for PHP security

And never, ever forget to filter input, escape output. Have fun