Question

I’m passing a string from one page to another, is the url encoding necessary here?

Like so:

<?=anchor('foo/bar/'.$id.'/'.$title, 'All')?>

function bar($id, $title) {
   $data['id'] = $id;
   $data['title'] = $title;
   $this->load->view('some_view', $data);
}

As you can see these variables have no interaction with a database. What is the best way to decode these variables?

Answer 1

Yes – what if one person gives someone else a link to site.com/foo/bar/3/<script...? (Answer: it’ll probably be caught by some other part of CI doing the escaping for you, but still :P)

Always escape all user input, even if you don’t think it matters, because you can’t be certain.