title: Should htmlspecialchars() be used on information on input or just before output?
body: <p>I take $_POST information and store it in a DB and later on query and print this information to the user. Should I use htmlspecialchars() before inserting this info or after I query it before I output it?</p>
  
  <p>In addition I need the ability for users to have the ability to use quotes and other everyday special chars. I know I can use the flag ENT_NOQUOTES but it feels like if I do that it leaves security holes.</p>
  
  <p>My site allows Bbcode and I want users to be able to use everyday characters without having to see "amp;lt;&amp;lt;?&amp;gt;&amp;".</p>
  
  <p>Patience with me &lt;--- noob is encouraged!
  Thanks :D</p>