How can I be as security tight as possible?

[eluser]darkhouse[/eluser]
I generally do all my XSS filtering in the rules of my form validation. That way I can apply it only to the ones that absolutely need it, and do other things in other fields to make sure they don't allow XSS even without using the XSS filter. For example, if you're accepting any field that should be a number, just use the rule 'numeric', because if it is a number, it can't have any XSS in it, and you didn't need to use the beefy XSS filter to prove that. 'valid_email' is another one. For things like postal/zip codes and things you know a certain format for, you can (and should) write a callback to make sure they're in that format, which would alleviate the need for XSS as well.