I have seen numerous posts on this subject but none really answered my questions.

I have some user input that is inserted into my DB and displayed back to the user later. Before inserting it into the DB I validate the input. When I need to display it back to the user I have been using two different methods.

The first is using `preg_replace()`. With this I can do things like remove all non alphanumeric characters. The second method is to use `filter_var()` with an option like `FILTER_SANITIZE_STRING`, which will strip tags and encode special characters. 

What I havent been able to find is which I *should* be using and of course, why.