filter input - escape output

Note that in the first link that Kenjis cited - that for echoing out a value in a form field - you don't have to use that function IF you are using the Codeigniter form helper. The form helper makes it much faster to build out form fields, and having that security there automatically is also a big plus.