How to remove html String in XSS filtering?

Hello,
That is not the intent of the xss_clean() method.  It is more geared for Java Script.

As the Codeigniter Security Class mentions, use the html_escape() function for escaping HTML.

The PHP function strip_tags() will remove HTML tags, not convert them. Alternatives for converting HTML entities to special characters are the PHP functions htmlspecialchars() and htmlentities().