Remove all html special chars Before saving the input from users in the database, I am using the below function to replace all HTML special chars. All my users will always be using the English Language.

Option 1

function clean($var) {
  $regEx="/[^a-zA-Z0-9 -_]/"; 
  $var = preg_replace($regEx, "", $var);
  return $var;
}


I want users to be able to only store


Letters (a to z) (Case Insensitive)
Numbers (0 to 9)
Space, Dash, Underscore


Will the above function is good for this job, or should I be using a more efficient/inbuilt function in PHP?

This is how I am using the function.

$userInput = htmlspecialchars(clean($userInput));


Option 2

function h($str_to_encode = ""){
    // Pregmatch will replacte all HTML characters with Empty string
    return preg_replace("/&amp;#?[a-z0-9]{2,8};/i","", htmlspecialchars($str_to_encode));
}


Regex from : https://stackoverflow.com/a/657670/4050261
Similar to Toto's answer, I recommend:

function clean($var) {
    return preg_replace("~[^\w -]+~", "", $var);
}


This will replace all occurrences of one or more consecutive forbidden characters.

Adding the "one or more" (+) quantifier means longer potential matches and fewer total replacements.  IOW, imagine a carton of a dozen eggs on yhe ground.  If the task was to pick up 12 eggs, you could squat 12 times picking them up one at a time, or just squat once and pickup the carton.

I have eliminated the unnecessary inclusion of "single-use variables" as there is no benefit in retaining them for readability.

Following this custom function call, the call of htmlspecialchars() is useless because there won't be any chars to convert.

On the other hand, if you wanted to call htmlspecialchars_decode() prior to clean() there is reasonable logic to that decision, but it depends on the input that you are expecting.