title: CakePHP: h() vs. Sanitize::html()
body: <p>CakePHP has a global function called <a href="http://book.cakephp.org/2.0/en/core-libraries/global-constants-and-functions.html#h" rel="nofollow"><code>h</code></a>. It's a convenience method for <code>htmlspecialchars</code>. CakePHP also has a utility called <a href="http://book.cakephp.org/2.0/en/core-utility-libraries/sanitize.html" rel="nofollow"><code>Sanitize</code></a>, which has a method called <a href="http://book.cakephp.org/2.0/en/core-utility-libraries/sanitize.html#Sanitize%3a%3ahtml" rel="nofollow"><code>html</code></a>. Here is part of its description:</p>
  
  <blockquote>
    <p>This method prepares user-submitted data for display inside HTML. This
    is especially useful if you don’t want users to be able to break your
    layouts or insert images or scripts inside of your HTML pages.</p>
  </blockquote>
  
  <p>When should each be used? Is one better than the other?</p>