xss_clean adds semicolon to anything with an &

[eluser]Pascal Kriete[/eluser]
reconstrukt, did you even try this?

The function protects GET variables (line 541 and 563):

Code:

$str = "http://mysite.com/user/login?s=1&return_url=some_encoded_url";
echo $this->input->xss_clean($str);

// Echos the url with no modifications