codeigniter xss validation

问题:

In CI userguide it says "The following is a list of all the prepping functions that are available to use:"

xss_clean = Runs the data through the XSS filtering function.....

Comments in my code has my question. Please read.

Note: Not interested enabling xss globally!!!

Thanks in advance

$this->form_validation->set_rules('select_language', 'Language', 'trim|required|xss_clean');

//Has this been cleaned above while validating and ready to be used or ...
$language = $this->input->post('text_fullname');

//... do I have to add true to run the data through the XSS filtering again myslef?
$language = $this->input->post('text_fullname', true);

回答1:

The post data won't be filtered until you actually run the form validation.

$this->form_validation->set_rules(
    'select_language',
    'Language',
    'trim|required|xss_clean'
);

// Unaltered $_POST input
$this->input->post('select_language');

$this->form_validation->run();

// Trimmed and xss_cleaned
$this->input->post('select_language');

Aside: In my opinion, xss filtering makes more sense to use where it actually matters, on output, not input. For example, if the xss filter is improved in a future release, you would want to take advantage of it right? If you filter input only, it would be impossible without running the xss_clean function again on your output, which defeats the purpose of using it as a form validation rule.

回答2:

As the other answer suggest you need to run the form validation first, but!

Your $this->input->post('text_fullname') wont be cleaned because you have set a validation rule for select_language and not text_fullname