I think you should sanitize your input fields. Code Igniter has built in functions for XSS http://ellislab.com/codeigniter/user-guide/libraries/input.h....

$var = $this->input->post('some_data', TRUE);