Can a URI var ever be malicious?

[eluser]luismartin[/eluser]
You are preventing from SQL injections by using CI's active record, but not from XSS attacks (javascript).
To do so, you can perform different steps:

- To set the XSS filtering config variable to TRUE: $config['global_xss_filtering'] = TRUE;

- To set to TRUE the second parameter of the post() and get() methods of Input class:
$clean_data = $this->input->post('myfield', true);

- To use the xss_clean method of Security class:
$clean_data = $this->security->xss_clean($data);