CodeIgniter: is $_POST already clean for db input?

This is my first app with CI and I want to know whether $_POST is clean and can I directly insert the data into db?

I have enabled $config['global_xss_filtering'] = TRUE;

Thank Yo开发者_StackOverflowu.

---

No, but $this->input->post() called without parameters will return all items passed through an XSS filter.

Also, if you are using it, the ActiveRecord documentation for codeigniter states the following:

It also allows for safer queries, since the values are escaped automatically by the system.

---

If you use CodeIgniter's Active Record access to the database, you don't have to worry about escaping values as it takes care of that for you.

---

No, because SQL is made up of pretty standard alpha numeric characters (the documentation). You should at the very least type your data and use php's mysql_real_escape_string() (the documentation).

This prevents SQL injection, whereas XSS filtering does not.

---

Short answer: no Long answer: maybe, if you use more secure DB methods

If you use a parametrized function (ex: pgSQL has pg_query_params()) then you don't need to sanitize the data, you only need to sanitize the data if you concat your SQL, which is generally considered subpar coding.

---

It looks like things have changed in the current version of CodeIgniter (2.0.0)...

$this->input->post does not work

and $_POST is automatically cleaned when global_xss_filtering is enabled.