Codeigniter Sanitisation Practices

I'm escaping it with smarty instead, as html_escape are just an alias for htmlspecialchars.

Inside href tags I use:
{$movie->url|htmlspecialchars:2:'UTF-8'|rawurlencode}

For everything else (except src, those need strict XSS protection):
{$movie->trailer|htmlentities:3:'UTF-8'}

New lines to <br>:
{$movie->notes|htmlentities:3:'UTF-8'|nl2br}

You should use a input validation too. So that you filter for just a-Z or what you need. So that you don't accept <script>