PHP: htmlspecialchars_decode, htmlentities and strip_tags – my best friends to prevent code injection attacks

As per title, I’ve been using htmlspecialchars_decode, htmlentities and strip_tags to prevent code injection attacks in PHP. You can combine the three in one line of code: $text = strip_tags(htmlentities(htmlspecialchars_decode($text)));