Codeigniter xss_clean issue

Question

In codeigniter the $this->input->post() (with xss_clean=true)

gives this output

[removed]alert('Hello')[removed]

for this input string

<script>alert('Hello')</script>

I want the output without containing [removed], i.e. alert('Hello')

Finally i ended up editing system/core/security.php file.

From

$str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '[removed]', $str);  

To

$str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '', $str);

It does the job.

I'm just asking if there is any alternative way to do this without changing system files ?

Additionally ,

Should i use codeigniter's xss_clean function ?

Answer 1

Yes, try extend class from CI_Security and write new function:

protected function _do_never_allowed($str)

it will be more OOP way.

EDIT:

CodeIgniter allow you extend core classes. See this link:

Extending CodeIgniter Security.php to enable logging

Answer 2

You should NEVER edit the core files.

Instead, you should just extend the Security class, from the application.

Create a file called "MY_Security.php" within ./application/core and extend the Security class.