Creating an API

[eluser]Colin Williams[/eluser]

but I can’t think of a situation where just having the $_GET array populated is a security concern

So set enable_query_strings to TRUE, set uri_protocol to something other than QUERY_STRING or AUTO (because we want clean URIs and don't want CI to think it needs to use the controller/function triggers in the query string) and get on with life. It's good to know how these settings actually work so you know what you need to, well, set them as.