Quick question, is it a better idea to call htmlentities() (or htmlspecialchars()) before or after inserting data into the database?
I have no experience of php but generally I always convert or escape nearest to output. You don't know when your output requirements will change, for example you may want to spit out data as XML, or JSON arrays and so escaping for HTML and then storing means you're limited to using the data as HTML alone.