title: Security in the codeigniter
body: <p>Good afternoon,</p>
  
  <p>I'm having some doubts about the safety in CodeIgniter, the first is:</p>
  
  <p>I have a controller: news.php, and in it I have a method called view</p>
  
  <p>Example:</p>
  
  <pre><code>class News extends CI_Controller{
  
      public function view( $id )
      {
          $this-&gt;load-&gt;model('news_model');
          $this-&gt;news_model-&gt;get_by_id( $id );
          // ...
      }
  }
  </code></pre>
  
  <p>This form of work is safe? no risk of SQL injection by URL? taking into consideration that this page is accessed so mywebpage / news / number_id. It would be interesting to filter through intval () or unnecessary?</p>
  
  <p>My second question is:</p>
  
  <p>By default CodeIgniter xss filter can post and get, but unknown a way to filter HTML by CodeIgniter, I created a helper down in CodeIgniter, there is some way similar to that in native CodeIgniter?</p>
  
  <pre><code>function remove_xss_html($string){
  
      if( is_array( $string ) ){
  
      $return_array = array();
  
          foreach( $string as $item )
          {
              if(!get_magic_quotes_gpc())
              {
                  $return_array[] =  addslashes( htmlspecialchars( strip_tags( $item ) ) );
              }
              else
              {
                  $return_array[] =  htmlspecialchars( strip_tags( $item ) );
              }
          }
              return $return_array;
      }
      else
      {
          return htmlspecialchars( strip_tags( $string ) );
      }
  }
  </code></pre>
  
  <p>and the third and last question is:</p>
  
  <p>If I send a variable $ this-> input-> post ('my_var') directly to the database without the filter, I run the risk of a sql injection? CodeIgniter or filters so safely?</p>
  
  <p>IMPORTANTE: My English is not very good, I used google translate and fix what I could.</p>
  
  <p>Thank you all ...</p>