title: Saving and Displaying HTML and special characters in a mysql database safely?
body: <p>The title basically sums it up. I built a small blog but I cant even post links in my articles! What can I do? I've tried <code>htmlentities()</code>, <code>htmlspecialchars()</code>, <code>real_escape_string()</code> and basically every form of escape there is. I am using PHP 5.3 with MySQL 5.1</p>
  
  <p>Here is my code to save the blog to the db:</p>
  
  <pre><code>function check_input($data, $problem='')
  {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlentities($data);
  if ($problem &amp;&amp; strlen($data) == 0)
  {
      die($problem);
  }
      return $data;
  }
  
  if(isset($_POST['addBlog'])) { //form submitted?
  
  // get form values, escape them and apply the check_input function
  $title = $link-&gt;real_escape_string($_POST['title']);
  $category = $link-&gt;real_escape_string(check_input($_POST['category'], "You must choose a category."));
  $content = $link-&gt;real_escape_string(check_input($_POST['blogContent'], "You can't publish a blog with no blog... dumbass."));
  $date = $link-&gt;real_escape_string(check_input($_POST['pub_date'], "What day is it foo?"));
  
   // our sql query
  $sql = $link-&gt;prepare("INSERT INTO pub_blogs (title, date, category, content) VALUES (?, ?, ?, ?)");
  $sql-&gt;bind_param('ssss', $title, $date, $category, $content);
  
  
  //save the blog     
  #mysqli_query($link, $sql) or die("Error in Query: " . mysqli_error($link));
  $sql-&gt;execute();
  
  if (!$sql) 
  {
      print "&lt;p&gt; Your Blog Was NOT Saved. &lt;/p&gt;";
  }
  }   
  </code></pre>
  
  <p>and here is my code to display the blog:</p>
  
  <pre><code>// Grab the data from our people table
          $result = mysqli_query($link, "SELECT * FROM pub_blogs ORDER BY date DESC") or die ("Could not access DB: " . mysqli_error($link));
  
          while ($row = mysqli_fetch_assoc($result))
          {   
              $id = $link-&gt;real_escape_string($row['id']);
              $title = $link-&gt;real_escape_string($row['title']);
              $date = $link-&gt;real_escape_string($row['date']);
              $category = $link-&gt;real_escape_string($row['category']);
              $content = $link-&gt;real_escape_string($row['content']);
  
              $id = stripslashes($id);
              $title = stripslashes($title);
              $date = stripslashes($date);
              $category = stripslashes($category);
              $content = stripslashes($content);
  
              echo "&lt;div class='blog_entry_container'&gt;";
              echo "&lt;span class='entry_date'&gt;&lt;a href='#'&gt;" .$date. "&lt;/a&gt; - &lt;/span&gt;&lt;span class='blog_title'&gt;&lt;a class='blogTitleLink' href='blog-view.php?id=" .$id. "'&gt;" .$title. "&lt;/a&gt;&lt;/span&gt;"; 
              echo "&lt;p&gt;" .$content. "&lt;/p&gt;";
              echo "&lt;/div&gt;";
          }
  </code></pre>