permitted_uri_chars in application/config.php not working [serious vulnerability]

[eluser]osci[/eluser]
I don't know if it should be escaped or not by limit.

But in your example you are protecting your search variable and not limit or offset or domain that you accept from the url. Shouldn't you escape everything you get from the url?