Just a thought: Wouldn't it be better to use a new array $cleaned_vars (or even better $validator->field) to prevent confusion? Whenever I see a $_POST var somewhere in the controller I'm not sure, if that $_POST['var'] was properly sanitized before...