在Codeigniter中处理用户输入的最佳实践

Question

I wonder what is the best and the most secured way of handling user's input in Codeigniter. Basically I have form for user's profile made by form helper like this:

echo form_open();
    echo form_label($this->lang->line('user_update_profile_first_name'), 'first_name');
    echo form_input(array('type' => 'text', 'name' => 'first_name', 'id' => 'first_name', 'maxlength' => '255', 'required' => 'true', 'value' => set_value('first_name', $user_profile['first_name'], false)));

    echo form_label($this->lang->line('user_update_profile_last_name'), 'last_name');
    echo form_input(array('type' => 'text', 'name' => 'last_name', 'id' => 'last_name', 'maxlength' => '255', 'required' => 'true', 'value' => set_value('last_name', $user_profile['last_name'], false)));

    echo form_label($this->lang->line('user_update_profile_birth_date'), 'birth_date');
    echo form_input(array('type' => 'text', 'name' => 'birth_date', 'id' => 'birth_date', 'maxlength' => '255', 'required' => 'true', 'value' => set_value('birth_date', $user_profile['birth_date'], 

    echo form_submit(array('value' => $this->lang->line('user_update_profile_form_submit'), 'name' => 'submit', 'class' => 'btn btn-primary'));
echo form_close();

As you can see in my code I am skipping xss filtering provided in set_value function due to xss filtering is done in form_input() already.

My Controller function for inserting data in DB looks like this

$validation_rules = array(
    array(
        'field' => 'first_name',
        'label' => $this->lang->line('user_update_profile_validation_error_first_name'),
        'rules' => 'required|trim|max_length[255]'
    ),
    array(
        'field' => 'last_name',
        'label' => $this->lang->line('user_update_profile_validation_error_last_name'),
        'rules' => 'required|trim|max_length[255]'
    ),
    array(
        'field' => 'birth_date',
        'label' => $this->lang->line('user_update_profile_validation_error_birth_date'),
        'rules' => 'required|trim|max_length[255]'
    )
);

$this->form_validation->set_rules($validation_rules);
if($this->form_validation->run()) {
    $user_data = array(
        'user_id' => $this->profile_data->user_id,
        'first_name' => $this->input->post('first_name', TRUE),
        'last_name' => $this->input->post('last_name', TRUE),
        'birth_date' => date('Y-m-d',strtotime($this->input->post('birth_date', TRUE)))
    );

    if($this->user_model->update_user_profile($user_data)) {
        $view_data['success'] = TRUE;
        $new_site_language = $this->language_model->getLanguageFolderById($user_data['site_language']);
        $this->lang->load('application/user_lang', $new_site_language);

    } else {
        $view_data['server_error'] = TRUE;
    }
}

I am filtering here data from user by provided $this->input->post('', true) xss filter. In model I am inserting data to DB by active record class. I am just wondering if this is the right and secure way of handling users input if there is not needed something like htmlspecialchars() . But what happens when someone have some "special" chars in name like for example Someone O'Sombody or some names from foreign countries? I am also showing data in navbar using html_escape($this->profile_data->first_name) to prevent running users potentially dangerous code. Did I get this whole "security thing" in the right way or there should be something changed because of potential danger?