title: User inputs, clean and sanitize before sending to db
body: <p><strong>I've searched a lot of the questions here and I found that they either very old or suggesting using prepared statements <em>PDO</em></strong> which <strong>I am not using</strong>.  So I need your help please.</p>
  
  <p>I have a small discussion/chat box where a user submit a message using a <code>&lt;textarea&gt;</code></p>
  
  <p>What I need is sanitize and filter the user input so it only accepts <em>plain texts</em> (e.g. no tags, no html tags, no scripts no links, etc).  <strong>Also</strong>, it is important to allow line breaks.</p>
  
  <p>Based on my reading I am doing the following in the following order:</p>
  
  <ol>
  <li><code>trim()</code></li>
  <li><code>htmlentities($comment, ENT_NOQUOTES)</code></li>
  <li><code>mysqli_real_escape_string()</code></li>
  <li><code>nl2br()</code></li>
  </ol>
  
  <p>Is what I am doing is right? or I am missing something?</p>
  
  <p><strong>Also</strong> is there anything I have to do when <code>echo</code>ing the data from the db?</p>
  
  <p>really, appreciate your help and kindness</p>