title: Security and Good Practice with Code Igniter
body: <p>I'm going through the documentation of Code Igniter and want to know if I get this right :</p>
  
  <ul>
  <li><p>Use $this->input->post(x,TRUE) instead of $_POST every time</p></li>
  <li><p>Best to use PDO. If not, do $this->security->xss_clean() and then $this->db->escape() before querying.</p></li>
  <li><p>Use bcrypt instead of their encryption system</p></li>
  </ul>
  
  <p>Also, to repopulate a form can I just put the post(x,TRUE) in the value="" field of the input or do I have to put it through prep_for_form() ?</p>
  
  <p>They should really write a documentation about how to handle data with CodeIgniter.</p>
  
  <p>EDIT : Apparently CodeIgniter's ActiveRecords already escape everything so no need to use db->escape()...</p>
  
  <p>EDIT2 : Apparently form_validation escapes as well. So doing a htmlspecialchars after having done a form_validation does double escaping... I've posted this issue here : <a href="https://github.com/EllisLab/CodeIgniter/issues/2230" rel="nofollow">https://github.com/EllisLab/CodeIgniter/issues/2230</a></p>