EllisLab/CodeIgniter — pull request #2351 by 52aa456eef8b60ad6754b31fbdcc77bb (2013-03-22 21:01:23+00:00)
Title: XSS Vulnerability 

Single and double quotes are not santized properly leading to an XSS vulnerability.
I personally would disallow all HTML by replacing xss_clean with htmlentities(STR, ENT_QUOTES),
as this will filter all kinds of evil, however you seem to allow some HTML.
My changes will mess up a user trying to enter as the
" will be changed into the entities, however this will stop the XSS.
The attack I discovered in my development was:

If VALUE_FROM_DB_HERE =

d" onmouseover=alert(444); "
or more evil
d" onmouseover=eval($('[name=\'field2\']').html())); "

the input becomes: