Inserting users using PDO prepared statements
Do not escape SQL query parameters when using PDO. PDO will do the right thing. If you call unnecessary escaping functions "just in case", then you end up mangling the data. That's how you get junk like "this &amp;amp; that" appearing in some broken web pages.

When would you want to escape text using htmlspecialchars()? When outputting text to be embedded in HTML. For example,

 &lt;input type="text" name="firstname" id="firstname" value="&lt;?php echo escape($_POST['firstname']); ?&gt;"&gt;


If you didn't call htmlspecialchars() on $_POST['firstname'], then a malicious user could break the page by inputting a name that contained double-quotes.