How to escape the form_dropdown values in CodeIgniter - codeigniter

Question

I built a web app with CodeIgniter 3, with PHP 7.0 and MySQL 5.6.
I have a table named 'departments' and the users can create rows with a form on the app.
The result in the database looks like this:
id 1
name accounting
In another form, I allow users to create a sub-department, which depends on one department. I let the user choose the department in a dropdown menu. The name of the options are the name of the department and the value is the id, according to the stored data.
<select name="department">
<option value="department_id">department_name</option>
...
</select>
But I use the CodeIgniter form_helper, so I get the data from my database, an array containing the rows (which are arrays):
echo form_drop_down('department', $departments_from_DB);
I read in the CI's DOC (about html_escape() function) that the form_helper should escape its content:
If you use any of the form helper functions listed on this page, the form values will be automatically escaped, so there is no need to call this function. Use it only if you are creating your own form elements.
But when I make a test with an alert script, the alert works, so...
I don't know how to escape the names of the departments. In fact I know, html_escape() works, but sometimes it's needed, sometimes not, sometimes it escapes twice, I'm a little confused.
A solution could be to write the html code in a loop, and escape the PHP value, but is there a more elegant solution ?

Answer 1

The form_dropdown() function escapes the values of the <option value="xxx">Name</option> tag ('xxx' in my example), but not the word between the tags ('Name' in my example).
To escape everything, use html_escape() on the array given the the form_dropdown() function.
Example:
$array_data = array(
'a' => 'Jack',
'<script>bad_script</script>' => 'John',
'c' => '<script>another_bad_script</script>'
);
// this will escape the array's key values (Jack and John are ok but not the last one)
echo form_dropdown('select_value', $array_data);
// this will escape the entire array
echo form_dropdown('select_value', html_escape($array_data));