如何在包含实体的字符串上使用PHP htmlentities

Question

I have a problem. In my database I allow users to submit post titles through an input containing html entities and plaintext. As per what I have read, I use mysqli_real_escape_string to escape their post before adding it to the database, and then use htmlentities when the html is being output onto a page. However if the user posts something like

 <div>( ͡° ͜ʖ ͡°)</div>

it gets mysqli escaped and stored in the database as

"<div>( &#865;° &#860;&#662; &#865;°)</div>"

if I then use htmlentities on this string when outputting, it will return nothing. This must be something to do with the html entities already in the string, because if I test

<div>plaintext</div>

it works fine. How can I escape the html entities such as < and > within a string already containing encoded entities?

Answer 1

The purpose of htmlentities is to convert special characters into browser-renderable strings. Browsers will render the converted characters, so no re-conversion through htmlentities is required.

(POST)->htmlentities->mysqli_real_escape_string->(stored)->(SELECT)->(display)