Fuel doesn't strip on input, it encodes on output.
We find that the behaviour of other frameworks that do strip or filter on input do it wrong, in that you loose input data, you have to do complicated things when you don't want to strip or filter (for example when you post HTML), it is very difficult to make completely secure, and once something insecure sneaks past the filter, your app is hacked.
In Fuel, all data is accepted and stored as posted (you should validate!), and encoded when displayed so that no matter where your data came from, and how it was treated, an insecure string will not compromise your app.
You can disable ALL output encoding by setting security.auto_filter_output to false in your config.php config fle.
You can disable output encoding on specific classes by whitelisting them in the security.whitelisted_classes array.
And your classes can implement the Sanitization interface, which allows you to customize the way variables in your objects are escaped. Model_Crud and ORM models implement this interface.
Donate
