password hashing doesn't work for all special characters

You should not use html_escape at all. As the user supplied password have been altered.

You should only escape on output not input.

Yeah, I've been thinking about that, and didn't like it.  It came that way from community_auth but I'm changing it as you suggest.

PHP Code:

$this->_change_password(
                    set_value('passwd', '', FALSE), //wasn't FALSE by default
                    set_value('passwd_confirm', '', FALSE), //wasn't FALSE by default
                    set_value('user_identification'),
                    set_value('recovery_code')
            ); 


---

It looks like I have an old version.... just checked out community_auth on bitbucket, and he's updated the section.

PHP Code:

$this->_change_password(
                $this->input->post('passwd'),
                $this->input->post('passwd_confirm'),
                set_value('user_identification'),
                set_value('recovery_code')
            );