actually, that’s the least favourable method. you should store the data as is in the database (using prepared statements) and apply htmlspecialchars() when you’re going to output the data. there may be cases, where you want to search your DB for certain keywords (e.g. <?php) that you won’t find if they’re encoded).