XSS_Clean filters no php tags

Hello @ll,

my Problems and Questions:

1. Problem

Input "<?php ?> <script>" in "recipients" field.

PHP Code:

//validate form input
$this->form_validation->set_rules('recipients', 'recipients', 'required|max_length[100]|xss_clean|callback_recipients_check');
...
...

//Callback function
public function recipients_check($recipients = '')
    {
        $foo = $this->security->xss_clean($recipients);

        echo "<pre>";

        print_r ($foo);

        echo "</pre>";
        exit;
    } 


The Return is "<?php ?> [removed]".

But why not filtering the PHP-Tags?
In User-Gguide Stands: xss_clean() does this automatically, if you use it.

A Question: Why not first Filtering and then Callback?
This is not the better Way?


Sry, for my English. I'm from Germany

Thank you for yours Help.