Preventing XSS injection in querystring

@jhob:
Remove the second value (true), it's not recommended to strip for XSS before inserting it into the database. That can leave you open to database truncated XSS attacks. You should validate your data on what you are expecting instead. Do the user specify only e-mail? Validate against that. Only numbers? Validate against that. And so forth.
Note: In your case with only searching, it dosen't matter. But I guess you are using it on every GET/POST as well.

@rolly:
A note regarding your regex, if the code got UTF8 you will need to add the letter 'u' at the end of the regex. Depending on what the user supplies, it can be helpful function.

@XtreemDeveloper:
That's not a good recommendation. It will leave you open to XSS attacks in ALL html attributes. You will need to escape the data depending on where you are using it.

Here's some good resources regarding the matter. The built in html_escape in CI are the same as htmlspecialchars and should only be used in "HTML BODY" if you don't want the HTML to be rendered. For everything else you need to need to take extra precautions.
https://www.owasp.org/index.php/XSS_(Cro...es_Summary
https://paragonie.com/blog/2015/06/preve...-need-know