Form Validation and xss_clean

[eluser]Madmartigan1[/eluser]
If the email is valid, how can it be dangerous? I'm no security expert...

If you are later using active record to insert or update then it would be as active record runs xss_clean.

Not following you there. Can you clarify? I always use active record and it does not xss_clean by default afaik. I ran into this when I had to edit templates and allow <scri*pt> tags.