Question

I use codeigniter as my framework and in the top of my controllers I am going to add a line of code that will send the uri_string (the last page the user requested) to a library which will send it into the users session and possibly eventually into a database.

My question is whether or not I need to validate this uri_string() at all or whether it is safe as is?

Answer 1

Keep in mind that the 'permitted_uri_chars' item in config.php will automatically prohibit any URL that contains non-permitted characters. So, as long as you haven’t modified that to include potentially malicious characters, you should be ok. From the comments in config.php:

By default only these are allowed: a-z 0-9~%.:_-

However, as Rooneyl mentions, it probably wouldn’t hurt anything to sanitize it anyway.