re-included URL encoded characters within _remove_invisible_characters() which were mistakenly pulled out in a previous commit, not released
diff --git a/system/libraries/Input.php b/system/libraries/Input.php
index 7465021..24c6c19 100644
--- a/system/libraries/Input.php
+++ b/system/libraries/Input.php
@@ -828,8 +828,10 @@
if ( ! isset($non_displayables))
{
- // every control character except newline (10), carriage return (13), and horizontal tab (09),
+ // every control character except newline (dec 10), carriage return (dec 13), and horizontal tab (dec 09),
$non_displayables = array(
+ '/%0[0-8bcef]/', // url encoded 00-08, 11, 12, 14, 15
+ '/%1[0-9a-f]/', // url encoded 16-31
'/[\x00-\x08]/', // 00-08
'/\x0b/', '/\x0c/', // 11, 12
'/[\x0e-\x1f]/' // 14-31