I take $_POST information and store it in a DB and later on query and print this information to the user. Should I use htmlspecialchars() before inserting this info or after
htmlspecialchars() is used before output to avoid XSS. And the database should better save the user's raw input.
htmlspecialchars()