Take the 2-minute tour ×

I'm using codeigniter and i'm trying to do a form_validation but the XSS_CLean don't function, don't know why, i have in config.php $config['global_xss_filtering'] = TRUE;


$this->form_validation->set_rules('username', 'Username', 'required|trim|min_length[4]|max_length[12]|xss_clean');

required, min_lenght and more functions perfect but xss_clean no... i try to pass '"<> and it pass, what im doing bad ?

pd: sorry for my english!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

<> is not an XSS attempt. The script removes potential XSS attacks. The function allows harmless tags such as <b>, <p>.

You can read the code itself. You will probably learn a lot about it.

If you want to encode all HTML entities, you can use the htmlentities function form PHP.

share|improve this answer
nothing more to say, i'm a noob. Really thanks :) read mode! –  kaseOga Nov 13 '12 at 2:05
I'm glad I could help. :) –  Maxime Morin Nov 13 '12 at 2:05

Your Answer


