Question

I am using codeigniter, and at the moment I am making full body search, and I am wondering what is the best practice to do this. For now I have this:

$keyword = $this->db->escape_like_str(trim($_POST['keyword']));

After that, search is performed. Is this safe or I need to do something more (XSS Filtering is on)?

Answer 1

Because you are accessing the _POST variable directly, you’re bypassing all CI’s XSS/Escaping and security features. You should be getting that as:

$this->input->post('keyword');

This is automatically escaped by CI, and you can perform other validations before just throwing it at the DB. Also if you use active record, then all values are automatically escaped as required too.