Question

This is my first app with CI and I want to know whether $_POST is clean and can I directly insert the data into db?

I have enabled $config['global_xss_filtering'] = TRUE;

Thank You.

Answer 1

No, but $this->input->post() called without parameters will return all items passed through an XSS filter.

Also, if you are using it, the ActiveRecord documentation for codeigniter states the following:

It also allows for safer queries,
since the values are escaped
automatically by the system.