SQL Injection protection in CodeIgniter

[eluser]WanWizard[/eluser]
Without actual code it's difficult for us to guess what is wrong.

Some ideas:
- your not using CI's active record, but code your queries by hand without proper escaping
- you use data from $_POST, not via $this->input->post

XSS filtering doesn't do anything with quotes in an input field, they are perfectly legal. They need to be escaped though if you use them in a query.