htmlentities or htmlspecialchars or stripslashes? Which one to use?
<p>When i insert user input data into the mysql database i use, <code>mysql_real_escape_string</code>.  The input data contains bbcode e.g. <code>[img][/img]</code>.  </p>

<p>Below is a line for when the html is output. </p>

<pre><code>    $information = $this-&gt;bbcode(stripslashes($this-&gt;swearfilter($row['information'])),1);
   echo $information;
</code></pre>

<p>Regarding this example, is this the correct way to prevent a XSS attack or do i use <code>htmlspecialchars($var,ENT_QUOTES)</code> or <code>htmlentities</code>?</p>
