Testing filtering of certain characters
It seems fine for me.

Some small changes:


I'd change the action to 

&lt;form action="&lt;?php echo htmlentities($_SERVER['PHP_SELF']); ?&gt;" method="post"&gt;


Using PHP_SELF in the action field of a form
I'd consider storing escaped data in the database instead of escaping them on every page requests for performance reasons if the page has lots of visitors.
"../post.sqlite" should be a constant.
I'd reorganize the code a little bit to use only one SQLite3 instance:

define("DB_FILE", "../post.sqlite");

$dbExists = file_exists(DB_FILE);
$db = new SQLite3(DB_FILE);
if (!$dbExists) {
   $db-&gt;exec("CREATE TABLE posts( id INTEGER PRIMARY KEY, post TEXT )");
}

if (isset($_POST['data'])) {
    if( isset($_POST['password']) &amp;&amp; $_POST['password'] === "correct horse battery staple" ){
        $statement = $db-&gt;prepare("INSERT INTO posts( id, post ) VALUES ( NULL, ? )");
        $statement-&gt;bindValue(1, $_POST['data'], SQLITE3_TEXT);
        $statement-&gt;execute();
    }
}

function posts($db) {
    $query = $db-&gt;query("SELECT post FROM posts ORDER BY id DESC");

    while ($row = $query-&gt;fetchArray(SQLITE3_ASSOC)) {
        print( "&lt;pre&gt;" );
        print( htmlentities( $row['post'] ) );
        print( "&lt;/pre&gt;&lt;hr /&gt;" );
    }
}

?&gt;
[...]

            &lt;?php posts($db); ?&gt;
[...]

&lt;?php
    $db-&gt;close();
?&gt;


It may be worth creating the table with IF NOT EXISTS in every execution instead of the file_exists check for simplicity: Creating an SQLite table only if it doesn't already exist