EllisLab/CodeIgniter — pull request #710 by johnnicely (2011-11-24 19:07:29+00:00)
Title: Changed form_open() to compare $action against base_url()

Checking for `strpos($action, $CI->config->site_url()) === FALSE` in `form_open()` causes the CSRF token to not be added in `form_open()` output. When the first parameter (`$uri`) of `site_url()` is empty, site_url's return value is the base URL plus the return value of `$CI->config->item('index_page')`. `form_open()` and CodeIgniter's URI routing do not require index.php to be in the URL, so any call to `form_open()` in which the `$action` parameter does not have 'index.php' will always return false for the `strpos()` call.