html_escape on set_value

[eluser]royduin[/eluser]
Hi!

For this example I've got a input in a view:

Code:

<input type="text" name="name" value="<? echo set_value('name'); ?>" />

If the form is submitted it will run trought the form_validation in it's controller. If it fails the value will be returned to the view. But if I fill in:

Code:

"><h1>It works!</h1>

The result will be:

Code:

&lt;input type="text" name="name" value=""&gt;&lt;h1>It works!</h1>" />

After the validation I see the H1! So it's not escaping with htmlspecialchars or CI's own function: html_escape.

What's the best solution to fix this and how do you fixed this?

Just run it trought html_escape in the view, like: ?

Code:

<input type="text" name="name" value="<? echo html_escape(set_value('name')); ?>" />

Thanks!