Active Records

[eluser]stef25[/eluser]
You always have to sanitize user input - anyone could type anything in to the URL and have that value fed in to your query. Even though CI's default settings don't allow funny characters (quotes etc) in the URL's and Active Record queries automatically escape values, it's always good to realize this.

I think you should be ok, just make sure you understand this