How can I be as security tight as possible?

[eluser]pistolPete[/eluser]
Restrict the permitted_uri_chars / leave the default:

Code:

$config['permitted_uri_chars'] = 'a-z 0-9~%.:_-';

Use the Input class instead of $_POST: User guide

Use the global_xss_filtering :

Code:

$config['global_xss_filtering'] = TRUE;