diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 9b012d3..e351566 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -32,7 +32,7 @@
 	var $ip_address			= FALSE;
 	var $user_agent			= FALSE;
 	var $allow_get_array	= FALSE;
-	
+
 	/**
 	 * Constructor
 	 *
@@ -40,19 +40,19 @@
 	 * and whether to allow the $_GET array
 	 *
 	 * @access	public
-	 */	
+	 */
 	function CI_Input()
-	{	
+	{
 		log_message('debug', "Input Class Initialized");
-	
+
 		$CFG =& load_class('Config');
 		$this->use_xss_clean	= ($CFG->item('global_xss_filtering') === TRUE) ? TRUE : FALSE;
-		$this->allow_get_array	= ($CFG->item('enable_query_strings') === TRUE) ? TRUE : FALSE;		
+		$this->allow_get_array	= ($CFG->item('enable_query_strings') === TRUE) ? TRUE : FALSE;
 		$this->_sanitize_globals();
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Sanitize Globals
 	 *
@@ -72,7 +72,7 @@
 		// Would kind of be "wrong" to unset any of these GLOBALS
 		$protected = array('_SERVER', '_GET', '_POST', '_FILES', '_REQUEST', '_SESSION', '_ENV', 'GLOBALS', 'HTTP_RAW_POST_DATA',
 							'system_folder', 'application_folder', 'BM', 'EXT', 'CFG', 'URI', 'RTR', 'OUT', 'IN');
-		
+
 		// Unset globals for security. 
 		// This is effectively the same as register_globals = off
 		foreach (array($_GET, $_POST, $_COOKIE, $_SERVER, $_FILES, $_ENV, (isset($_SESSION) && is_array($_SESSION)) ? $_SESSION : array()) as $global)
@@ -92,7 +92,7 @@
 					{
 						unset($GLOBALS[$key]);
 					}
-					
+			
 					if (is_array($val))
 					{
 						foreach($val as $k => $v)
@@ -103,7 +103,7 @@
 							}
 						}
 					}
-				}	
+				}
 			}
 		}
 
@@ -122,30 +122,30 @@
 				}
 			}
 		}
-		
+
 		// Clean $_POST Data
 		if (is_array($_POST) AND count($_POST) > 0)
 		{
 			foreach($_POST as $key => $val)
-			{				
+			{
 				$_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
-			}			
+			}
 		}
-	
+
 		// Clean $_COOKIE Data
 		if (is_array($_COOKIE) AND count($_COOKIE) > 0)
 		{
 			foreach($_COOKIE as $key => $val)
-			{			
+			{
 				$_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
-			}	
+			}
 		}
-		
+
 		log_message('debug', "Global POST and COOKIE data sanitized");
-	}	
-	
+	}
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Clean Input Data
 	 *
@@ -155,7 +155,7 @@
 	 * @access	private
 	 * @param	string
 	 * @return	string
-	 */	
+	 */
 	function _clean_input_data($str)
 	{
 		if (is_array($str))
@@ -167,25 +167,25 @@
 			}
 			return $new_array;
 		}
-		
+
 		// We strip slashes if magic quotes is on to keep things consistent
 		if (get_magic_quotes_gpc())
 		{
 			$str = stripslashes($str);
 		}
-		
+
 		// Should we filter the input data?
 		if ($this->use_xss_clean === TRUE)
 		{
 			$str = $this->xss_clean($str);
 		}
-		
+
 		// Standardize newlines
 		return preg_replace("/\015\012|\015|\012/", "\n", $str);
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Clean Keys
 	 *
@@ -198,7 +198,7 @@
 	 * @return	string
 	 */
 	function _clean_input_keys($str)
-	{	
+	{
 		 if (! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
 		 {
 			exit('Disallowed Key Characters.');
@@ -208,7 +208,7 @@
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Fetch an item from the GET array
 	 *
@@ -218,7 +218,7 @@
 	 * @return	string
 	 */
 	function get($index = '', $xss_clean = FALSE)
-	{		
+	{
 		if (! isset($_GET[$index]))
 		{
 			return FALSE;
@@ -229,7 +229,7 @@
 			if (is_array($_GET[$index]))
 			{
 				foreach($_GET[$index] as $key => $val)
-				{					
+				{
 					$_GET[$index][$key] = $this->xss_clean($val);
 				}
 			}
@@ -241,9 +241,9 @@
 
 		return $_GET[$index];
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Fetch an item from the POST array
 	 *
@@ -253,7 +253,7 @@
 	 * @return	string
 	 */
 	function post($index = '', $xss_clean = FALSE)
-	{		
+	{
 		if (! isset($_POST[$index]))
 		{
 			return FALSE;
@@ -264,7 +264,7 @@
 			if (is_array($_POST[$index]))
 			{
 				foreach($_POST[$index] as $key => $val)
-				{					
+				{
 					$_POST[$index][$key] = $this->xss_clean($val);
 				}
 			}
@@ -276,9 +276,9 @@
 
 		return $_POST[$index];
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Fetch an item from the COOKIE array
 	 *
@@ -303,7 +303,7 @@
 				{
 					$cookie[$key] = $this->xss_clean($val);
 				}
-		
+
 				return $cookie;
 			}
 			else
@@ -318,7 +318,7 @@
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Fetch an item from the SERVER array
 	 *
@@ -328,7 +328,7 @@
 	 * @return	string
 	 */
 	function server($index = '', $xss_clean = FALSE)
-	{		
+	{
 		if (! isset($_SERVER[$index]))
 		{
 			return FALSE;
@@ -338,12 +338,12 @@
 		{
 			return $this->xss_clean($_SERVER[$index]);
 		}
-		
+
 		return $_SERVER[$index];
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Fetch the IP Address
 	 *
@@ -356,7 +356,7 @@
 		{
 			return $this->ip_address;
 		}
-		
+
 		if ($this->server('REMOTE_ADDR') AND $this->server('HTTP_CLIENT_IP'))
 		{
 			 $this->ip_address = $_SERVER['HTTP_CLIENT_IP'];
@@ -373,29 +373,29 @@
 		{
 			 $this->ip_address = $_SERVER['HTTP_X_FORWARDED_FOR'];
 		}
-		
+
 		if ($this->ip_address === FALSE)
 		{
 			$this->ip_address = '0.0.0.0';
 			return $this->ip_address;
 		}
-		
+
 		if (strstr($this->ip_address, ','))
 		{
 			$x = explode(',', $this->ip_address);
 			$this->ip_address = end($x);
 		}
-		
+
 		if (! $this->valid_ip($this->ip_address))
 		{
 			$this->ip_address = '0.0.0.0';
 		}
-				
+		
 		return $this->ip_address;
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Validate IP Address
 	 *
@@ -408,7 +408,7 @@
 	function valid_ip($ip)
 	{
 		$ip_segments = explode('.', $ip);
-		
+
 		// Always 4 segments needed
 		if (count($ip_segments) != 4)
 		{
@@ -429,12 +429,12 @@
 				return FALSE;
 			}
 		}
-		
+
 		return TRUE;
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * User Agent
 	 *
@@ -447,14 +447,14 @@
 		{
 			return $this->user_agent;
 		}
-	
+
 		$this->user_agent = (! isset($_SERVER['HTTP_USER_AGENT'])) ? FALSE : $_SERVER['HTTP_USER_AGENT'];
-		
+
 		return $this->user_agent;
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Filename Security
 	 *
@@ -497,13 +497,13 @@
 						"%3f", 		// ?
 						"%3b", 		// ;
 						"%3d"		// =
-        			);
-        			
-        return stripslashes(str_replace($bad, '', $str));   
+					);
+
+		return stripslashes(str_replace($bad, '', $str));
 	}
-	
+
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * XSS Clean
 	 *
@@ -542,10 +542,10 @@
 			{
 				$str[$key] = $this->xss_clean($str[$key]);
 			}
-			
+	
 			return $str;
 		}
-		
+
 		/*
 		 * Remove Null Characters
 		 *
@@ -572,7 +572,7 @@
 		 *
 		 */
 		$str = preg_replace('#(&\#?[0-9a-z]+)[\x00-\x20]*;?#i', "\\1;", $str);
-		
+
 		/*
 		 * Validate UTF16 two byte encoding (x00) 
 		 *
@@ -586,7 +586,7 @@
 		 */
 		 
 		$str = str_replace($this->xss_hash(), '&', $str);
-		
+
 		/*
 		 * URL Decode
 		 *
@@ -596,9 +596,9 @@
 		 *
 		 * Note: Use rawurldecode() so it does not remove plus signs
 		 *
-		 */	
+		 */
 		$str = rawurldecode($str);
-		
+
 		/*
 		 * Convert character entities to ASCII 
 		 *
@@ -607,15 +607,15 @@
 		 * these are the ones that will pose security problems.
 		 *
 		 */
-		
+
 		$str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", array($this, '_attribute_conversion'), $str);
 		 
 		$str = preg_replace_callback("/<([\w]+)[^>]*>/si", array($this, '_html_entity_decode_callback'), $str);
 
 		/*
-		
+
 		Old Code that when modified to use preg_replace()'s above became more efficient memory-wise
-		
+
 		if (preg_match_all("/[a-z]+=([\'\"]).*?\\1/si", $str, $matches))
 		{        
 			for ($i = 0; $i < count($matches[0]); $i++)
@@ -639,7 +639,7 @@
 			}
 		}
 		*/
-		
+
 		/*
 		 * Convert all tabs to spaces
 		 *
@@ -649,12 +649,14 @@
 		 * so we use str_replace.
 		 *
 		 */
-		 
-		$str = str_replace("\t", " ", $str);
+		
+ 		if (strpos($str, "\t") !== FALSE) {
+			$str = str_replace("\t", " ", $str);
+		}		
 
 		/*
 		 * Not Allowed Under Any Conditions
-		 */	
+		 */
 		$bad = array(
 						'document.cookie'	=> '[removed]',
 						'document.write'	=> '[removed]',
@@ -677,12 +679,12 @@
 						"expression\s*\("	=> '[removed]', // CSS and IE
 						"Redirect\s+302"	=> '[removed]'
 					);
-					
+			
 		foreach ($bad as $key => $val)
 		{
 			$str = preg_replace("#".$key."#i", $val, $str);   
 		}
-	
+
 		/*
 		 * Makes PHP tags safe
 		 *
@@ -692,16 +694,16 @@
 		 *
 		 * But it doesn't seem to pose a problem.
 		 *
-		 */		
+		 */
 		$str = str_replace(array('<?php', '<?PHP', '<?', '?'.'>'),  array('&lt;?php', '&lt;?PHP', '&lt;?', '?&gt;'), $str);
-	
+
 		/*
 		 * Compact any exploded words
 		 *
 		 * This corrects words like:  j a v a s c r i p t
 		 * These words are compacted back to their correct state.
 		 *
-		 */		
+		 */
 		$words = array('javascript', 'expression', 'vbscript', 'script', 'applet', 'alert', 'document', 'write', 'cookie', 'window');
 		foreach ($words as $word)
 		{
@@ -710,31 +712,31 @@
 			{
 				$temp .= substr($word, $i, 1)."\s*";
 			}
-			
+	
 			// We only want to do this when it is followed by a non-word character
 			// That way valid stuff like "dealer to" does not become "dealerto"
 			$str = preg_replace('#('.substr($temp, 0, -3).')(\W)#ise', "preg_replace('/\s+/s', '', '\\1').'\\2'", $str);
 		}
-	
+
 		/*
 		 * Remove disallowed Javascript in links or img tags
 		 */
 		do
 		{
 			$original = $str;
-			
+	
 			if ((version_compare(PHP_VERSION, '5.0', '>=') === TRUE && stripos($str, '</a>') !== FALSE) OR 
 				 preg_match("/<\/a>/i", $str))
 			{
 				$str = preg_replace_callback("#<a.*?</a>#si", array($this, '_js_link_removal'), $str);
 			}
-			
+	
 			if ((version_compare(PHP_VERSION, '5.0', '>=') === TRUE && stripos($str, '<img') !== FALSE) OR 
 				 preg_match("/img/i", $str))
 			{
 				$str = preg_replace_callback("#<img.*?".">#si", array($this, '_js_img_removal'), $str);
 			}
-			
+	
 			if ((version_compare(PHP_VERSION, '5.0', '>=') === TRUE && (stripos($str, 'script') !== FALSE OR stripos($str, 'xss') !== FALSE)) OR
 				 preg_match("/(script|xss)/i", $str))
 			{
@@ -742,7 +744,7 @@
 			}
 		}
 		while($original != $str);
-		
+
 		unset($original);
 
 		/*
@@ -752,10 +754,10 @@
 		 * the event handler and anything up to the closing >,
 		 * but it's unlikely to be a problem.
 		 *
-		 */		
+		 */
 		$event_handlers = array('onblur','onchange','onclick','onfocus','onload','onmouseover','onmouseup','onmousedown','onselect','onsubmit','onunload','onkeypress','onkeydown','onkeyup','onresize', 'xmlns');
 		$str = preg_replace("#<([^>]+)(".implode('|', $event_handlers).")([^>]*)>#iU", "&lt;\\1\\2\\3&gt;", $str);
-	
+
 		/*
 		 * Sanitize naughty HTML elements
 		 *
@@ -765,9 +767,9 @@
 		 * So this: <blink>
 		 * Becomes: &lt;blink&gt;
 		 *
-		 */		
+		 */
 		$str = preg_replace('#<(/*\s*)(alert|applet|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|layer|link|meta|object|plaintext|style|script|textarea|title|xml|xss)([^>]*)>#is', "&lt;\\1\\2\\3&gt;", $str);
-		
+
 		/*
 		 * Sanitize naughty scripting elements
 		 *
@@ -782,14 +784,14 @@
 		 *
 		 */
 		$str = preg_replace('#(alert|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', "\\1\\2&#40;\\3&#41;", $str);
-						
+					
 		/*
 		 * Final clean up
 		 *
 		 * This adds a bit of extra precaution in case
 		 * something got through the above filters
 		 *
-		 */	
+		 */
 		$bad = array(
 						'document.cookie'	=> '[removed]',
 						'document.write'	=> '[removed]',
@@ -812,19 +814,19 @@
 						"expression\s*\("	=> '[removed]', // CSS and IE
 						"Redirect\s+302"	=> '[removed]'
 					);
-					
+				
 		foreach ($bad as $key => $val)
 		{
 			$str = preg_replace("#".$key."#i", $val, $str);   
 		}
-		
-						
+
+
 		log_message('debug', "XSS Filtering completed");
 		return $str;
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Random Hash for protecting URLs
 	 *
@@ -832,22 +834,22 @@
 	 * @return	string
 	 */
 	function xss_hash()
-	{	
+	{
 		if ($this->xss_hash == '')
 		{
 			if (phpversion() >= 4.2)
 				mt_srand();
 			else
 				mt_srand(hexdec(substr(md5(microtime()), -8)) & 0x7fffffff);
-			
+
 			$this->xss_hash = md5(time() + mt_rand(0, 1999999999));
 		}
-		
+
 		return $this->xss_hash;
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * JS Link Removal
 	 *
@@ -864,7 +866,7 @@
 	{
 		return preg_replace("#<a.+?href=.*?(alert\(|alert&\#40;|javascript\:|window\.|document\.|\.cookie|<script|<xss).*?\>.*?</a>#si", "", $match[0]);
 	}
-	
+
 	/**
 	 * JS Image Removal
 	 *
@@ -883,7 +885,7 @@
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * Attribute Conversion
 	 *
@@ -897,7 +899,7 @@
 	{
 		return str_replace('>', '&lt;', $match[0]);
 	}
-	
+
 	// --------------------------------------------------------------------
 
 	/**
@@ -918,7 +920,7 @@
 	}
 
 	// --------------------------------------------------------------------
-	
+
 	/**
 	 * HTML Entities Decode
 	 *
@@ -937,7 +939,7 @@
 	/* -------------------------------------------------
 	/*  Replacement for html_entity_decode()
 	/* -------------------------------------------------*/
-	
+
 	/*
 	NOTE: html_entity_decode() has a bug in some PHP versions when UTF-8 is the
 	character set, and the PHP developers said they were not back porting the
@@ -946,30 +948,30 @@
 	function _html_entity_decode($str, $charset='UTF-8')
 	{
 		if (stristr($str, '&') === FALSE) return $str;
-			
+
 		// The reason we are not using html_entity_decode() by itself is because
 		// while it is not technically correct to leave out the semicolon
 		// at the end of an entity most browsers will still interpret the entity
 		// correctly.  html_entity_decode() does not convert entities without
 		// semicolons, so we are left with our own little solution here. Bummer.
-	
+
 		if (function_exists('html_entity_decode') && (strtolower($charset) != 'utf-8' OR version_compare(phpversion(), '5.0.0', '>=')))
 		{
 			$str = html_entity_decode($str, ENT_COMPAT, $charset);
 			$str = preg_replace('~&#x([0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str);
 			return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str);
 		}
-		
+
 		// Numeric Entities
 		$str = preg_replace('~&#x([0-9a-f]{2,5});{0,1}~ei', 'chr(hexdec("\\1"))', $str);
 		$str = preg_replace('~&#([0-9]{2,4});{0,1}~e', 'chr(\\1)', $str);
-	
+
 		// Literal Entities - Slightly slow so we do another check
 		if (stristr($str, '&') === FALSE)
 		{
 			$str = strtr($str, array_flip(get_html_translation_table(HTML_ENTITIES)));
 		}
-		
+
 		return $str;
 	}