title: How to display htmlspecialchars on the html?
body: <p>I've read here:<br>
  <a href="https://stackoverflow.com/a/8932454/4301970">https://stackoverflow.com/a/8932454/4301970</a><br>
  that htmlspecialchars() is very effective preventing xss attacks.</p>
  
  <p>I'm receiving formated text from a wysiwyg editor, for example:</p>
  
  <pre><code>&lt;p&gt;
      &lt;em&gt;
          &lt;strong&gt;&lt;span style="font-size:36pt;"&gt;test&lt;/span&gt;&lt;/strong&gt;
      &lt;/em&gt;
  &lt;/p&gt;
  </code></pre>
  
  <p>Encoding this on my html:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang=en&gt;
  &lt;head&gt;
      &lt;title&gt;&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;?php echo htmlspecialchars('&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;span style="font-size:36pt;"&gt;test&lt;/span&gt;&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;', ENT_QUOTES); ?&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Will output on browser:</p>
  
  <pre><code>&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;span style="font-size:36pt;"&gt;test&lt;/span&gt;&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;
  </code></pre>
  
  <p>How can I display the formatted text correctly, while preventing XSS injections?</p>