php - CodeIgniter - why use xss_clean -

If I'm clearing my DB inserts, and I'm avoiding HTML, then I htmlentities ($ text , ENT_COMPAT), 'UTF-8') - Does it make sense to filter the input with xss_clean? What does this other benefit?

is broad, even silly, does nothing to prevent 90% Xs in this function . As if the word alert but document.cookie are not visible, any hacker is not going to use warning in their code, Are going to kidnap the cookie or can read the CSRF token to create XHR.

Although running htmlentities () or htmlspecialchars () is incompatible with a xss_clean () problem Fixes and htmlentities ($ text, ENT_COMPAT, 'UTF-8') fails the following:

  & lt ;? Php print "& lt; img src = '$ var' & gt;"; ? & Gt;   
 A simple policy is:  
 
 '% 20onload = alert (/ xss /)   
 will add it  onload =  event handler on the image tag. One way to prevent this form of XSS is by  htmlspecialchars ($ var, ENT_QUOTES);  or in this case  xss_clean ()  will also stop it.  
 However, coded by the xss_clean () document:  
 
 Anything is 100% innocent at any time, of course, but I am not able to pass anything to the filter .   
 It is being said that, XSS is an  output problem   no  is an  input problem . For example, this function can not be taken into consideration that the variable already has a  & lt; Script & gt;  The tag or event is within the handler, it does not even stop DOM-based XSS. You should keep in mind  how you are using data  to use the best function. Filtering all the data on the input is a  poor behavior  not only is it unsafe but it also corrupts the data which can make it difficult to compare.