title: Does codeigniter automatically sanitize email messages?
body: <p>I read CI's documentation and about 50 posts, but I can't find a best practice for handling user inputs for email sending. For their example code from the manual:</p>
  
  <pre><code>$this-&gt;email-&gt;clear();
  
  $this-&gt;email-&gt;to($address);
  $this-&gt;email-&gt;from('your@example.com');
  $this-&gt;email-&gt;subject('Here is your info '.$name);
  $this-&gt;email-&gt;message('Hi '.$name.' Here is the info you requested.');
  $this-&gt;email-&gt;send();
  </code></pre>
  
  <p>They have static text, which we know is safe. What if I used:</p>
  
  <pre><code>$this-&gt;email-&gt;to($this-&gt;input-&gt;post('message'));
  </code></pre>
  
  <p>Would I need to sanitize it somehow first to make sure that it first or does CI handle that in the email helper?</p>
  
  <p>If I do need to, does this suffice with XSS protection turned on or do I need to do more than:</p>
  
  <pre><code>$this-&gt;form_validation-&gt;set_rules('message', 'Message', 'required');
  </code></pre>
  
  <p>Does form validation with XSS protection enabled do the trick?</p>