Can a URI var ever be malicious?

[eluser]luismartin[/eluser]
In that case I'm not sure at 100%.

Well, in case you (for some reason) urldecode some data from the URL which are url encoded (so that it passes the CI URI filter) you might get the malicious script as it is.

Example:

Code:

<scri*pt>alert('hello')</scri*pt>

to

Code:

#3cscript#3ealert(#27hello#27)#3c#2fscript#3e

(replacing # with % and removing the asterisks , as the forum filter censors any script tag)

But I'm not absolutely sure of this behaviour.