Quick question, is it a better idea to call htmlentities() (or htmlspecialchars()) before or after inserting data into the database?
htmlentities()
htmlspecialchars()
It is the way of the craftsman to "measure twice, optimize once".