securing the functions in the controller

[eluser]CI_avatar[/eluser]
Buso is right, private function must have <_> + <variable name>. And you cannot call them directly. Let the public functions call your private function.