Added Example Code
------------------

Please read below for full details, this is an example function that can be put in a controller which generates the same results. The database structure is posted further down:

```
public function test()
    {
        if(isset($_POST['comment_original']))
        {
            $this->load->library('form_validation');

            $comment_original = $this->form_validation->xss_clean(html_escape($_POST['comment_original']));

            var_dump($comment_original);

            $this->db->insert('comments', array(
                'comment_set_id'        =>  2993,
                'comment_user_id'       =>  40,
                'comment_original'      =>  $comment_original,
                'comment_enabled'       =>  1,
                'comment_is_spam'       =>  0,
                'comment_time_added'    =>  1358090826,
                'comment_time_updated'  =>  1358090826
            ));

            var_dump($this->db->last_query());
        }

        $this->output->set_output('<form method="post">
            <textarea name="comment_original"></textarea>
            <br />
            <input type="submit" />
        </form>');
    }

```

The original problem
--------------------

Hey guys when I try and insert a string like this into my database, into a TEXT column.

> 
> <http://img.chronofoot.com>/éric-di-meco/interview-eric-di-meco\_66454\_w250.jpg
> 
> 
> 

It winds up in the database as:

> 
> <http://img.chronofoot.com/>
> 
> 
> 

I've done $this->db->last\_query() to show what query Codeigniter is running and it returns this:

```
INSERT INTO `comments` (`comment_set_id`, `comment_user_id`, `comment_original`, `comment_html`, `comment_enabled`, `comment_is_spam`, `comment_time_added`, `comment_time_updated`, `comment_ip_address`) VALUES (2993, 40, 'http://img.chronofoot.com/éric-di-meco/interview-eric-di-meco_66454_w250.jpg', 'http://img.chronofoot.com/éric-di-meco/interview-eric-di-meco_66454_w250.jpg', 1, 0, 1358090826, 1358090826, 'XXX')

```

So it would seem it isn't being stripped out before it tries to do the insert. Putting that exact string into php my admin inserts just fine with the full string.

Anyone have any idea why this is happening? 

Extra Information
-----------------

It will strip anything after the "é" so the same thing will happen to a string like this:

> 
> <http://img.chronofoot.com>/éric-di-meco/interview-eric-di-meco\_66454\_w250.jpg This is extra dummy text
> 
> 
> 

The string being posted in the form is actually this:

> 
> <http://img.chronofoot.com/%E9ric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

But xss\_clean converts %E9 to é which isn't actually what I want, but i'm tentative to to do anything to the core xxs\_clean function.

On a final note, this is what my table looks like, although I don't think that makes any difference:

```
CREATE TABLE IF NOT EXISTS `comments` (
  `comment_id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `comment_set_id` int(10) unsigned NOT NULL,
  `comment_user_id` mediumint(6) unsigned NOT NULL,
  `comment_original` text NOT NULL,
  `comment_html` text NOT NULL,
  `comment_attachments` text,
  `comment_time_added` int(10) unsigned NOT NULL,
  `comment_time_updated` int(10) unsigned NOT NULL,
  `comment_enabled` tinyint(1) NOT NULL DEFAULT '1',
  `comment_is_spam` tinyint(1) NOT NULL DEFAULT '0',
  `comment_has_attachments` tinyint(1) NOT NULL DEFAULT '0',
  `comment_has_edits` tinyint(1) NOT NULL DEFAULT '0',
  `comment_ip_address` varchar(64) DEFAULT NULL,
  PRIMARY KEY (`comment_id`)
) ENGINE=MyISAM  DEFAULT CHARSET=utf8

```

Updated Question: Escaping HTML
-------------------------------

Just thought i'd some extra information.

So like I said the actual string being posted is this:

> 
> <http://img.chronofoot.com/%E9ric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

This goes through html\_escape and then xss\_clean. If I put it through xss\_clean first then it returns an empty string

```
var_dump($this->form_validation->xss_clean(html_escape($_POST['comment_original'])))
//Returns http://img.chronofoot.com/éric-di-meco/interview-eric-di-meco_66454_w250.jpg

```

And xss\_clean first

```
var_dump(html_escape($this->form_validation->xss_clean($_POST['comment_original'])))
//Returns ''

```

htmlentities will solve it in a way, in that it will convert the string to this:

> 
> <http://img.chronofoot.com/éric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

But this form is just adding a comment, so any amount of text could be added and htmlentities so if something like this is posted:

> 
> This won't work <http://img.chronofoot.com/%E9ric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

html\_escape() would convert it to this

> 
> This won't work <http://img.chronofoot.com/%E9ric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

xss\_clean() then converts it to this

> 
> This won't work <http://img.chronofoot.com>/éric-di-meco/interview-eric-di-meco\_66454\_w250.jpg
> 
> 
> 

And then htmlentities() would convert it to this:

> 
> This won&#039;t work <http://img.chronofoot.com/éric-di-meco/interview-eric-di-meco_66454_w250.jpg>
> 
> 
> 

This would of course destroy the word "won't" as the ampersand would be converted twice.