Overriding global XSS filtering

[eluser]Matty[/eluser]
[quote author="Twisted1919" date="1307974817"]Basically, what you need to do, is that at the beginning of the request, right before the global cleaning is taking place, make a copy of the $_POST array and use that copy when you want to get the original, uncleaned variables.
Extending the security class might be the perfect way of doing this, something like:

Code:

class MY_Security extends CI_Security{

  public $original_post_array;

  public function __construct()
  {
     if($this->original_post_array===null&&!empty($_POST))
        $this->original_post_array=$_POST;
     parent::__construct();
  }

}

Then in your code, you can check like:

Code:

if(isset($this->security->original_post_array['password']))
{
   // do something here with the original value.
}

Please note, if you use CKEDITOR, or any other editor, the xss_clean() method will strip many of the elements attributes, exp:

Code:

<div >BOLD FONT ? </div>
//becomes:
<div>BOLD FONT ? </div>

So having a variable that holds the original $_POST array is a good idea in your case, maybe instead of cleaning the content of an editor with xss_clean() you might wanna do it with html purifier.[/quote]

Brilliant, this is just what I was looking for and it works perfectly.