html_escape on set_value

[eluser]royduin[/eluser]
Thanks but as you can see the input is for a name, but if somebody don't fill in his name but:

Code:

"><h1>It works!</h1>

It "breaks" the code and the H1 is visible when the form validation in the controller fails! So set_value doesn't escape thinks like the html_escape function do.

So my question is how people fix this or what's the best practice?