HTML::chars() decode about core HOT 5 CLOSED

I can see no reason to store HTML chars in your db, you're supposed to use that at output, not all the time.

from core.

Yes, as @kemo has said, you're supposed to use HTML::chars when outputting unsafe strings not before inserting them into the database. Having encoded strings in your database causes problems such not being able to search the strings in your database properly. Also, what if you wanted to put your data into a JSON file, you would have lots of unwanted HTML encoding in it.

from core.

great, I did!
My idea is to clean the data before storing in the database.
Aka @feketegy in http://www.sitepoint.com/php-security-cross-site-scripting-attacks-xss/

it looks like "HTML Purifier" is better for this.

from core.

Use HTML Purifier if you want to preserve HTML in your content, otherwise strip all tags out from it.

from core.

otherwise strip all tags out from it

even if you strip tags, output should be escaped.

from core.