When to use: htmlspecialchars? [duplicate]

Question

I need to convert my strings to special characters using:

 htmlspecialchars

My question is, should I convert my data before submitting it to a database or should I convert it before I display it?

Answer 1

You should sanitize data before inserting it into a database, and escape it on retrieval.

htmlspecialchars is used for escaping, so it should be after you’ve fetched it from the database.