Can I restrict the type of php functions and variables usable in a view?

[eluser]Michael Wales[/eluser]
I wouldn't let them use any PHP at all. I would have them use a templating language (CI has one built-in) and then parse their input.

There are just to many security holes if you let them use PHP. You will never block them from everything (and, depending on your target audience, your likely to find your users are more comfortable with the template language than with PHP).