Codeigniter，安全搜索的最佳实践

Question

I am using codeigniter, and at the moment I am making full body search, and I am wondering what is the best practice to do this. For now I have this:

$keyword = $this->db->escape_like_str(trim($_POST['keyword']));

After that, search is performed. Is this safe or I need to do something more (XSS Filtering is on)?

Answer 1

Because you are accessing the _POST variable directly, you're bypassing all CI's XSS/Escaping and security features. You should be getting that as:

$this->input->post('keyword');

This is automatically escaped by CI, and you can perform other validations before just throwing it at the DB. Also if you use active record , then all values are automatically escaped as required too.