title: Decoding mysql_real_escape_string() for outputting HTML
body: <p>I'm trying to protect myself from sql injection and am using:</p>
  
  <pre><code>mysql_real_escape_string($string);
  </code></pre>
  
  <p>When posting HTML it looks something like this:</p>
  
  <pre><code>&lt;span class="\&amp;quot;className\&amp;quot;"&gt;
  &lt;p class="\&amp;quot;pClass\&amp;quot;" id="\&amp;quot;pId\&amp;quot;"&gt;&lt;/p&gt;
  &lt;/span&gt;
  </code></pre>
  
  <p>I'm not sure how many other variations real_escape_string adds so don't want to just replace a few and miss others... How do I "decode" this back into correctly formatted HTML, with something like:</p>
  
  <pre><code>html_entity_decode(stripslashes($string));
  </code></pre>