php - Insert HTML content into db table securely -

i'm using html function inserting html content db table , filter filtering user inputs against sql injection attacks. getting output prntscr.com/3c8ht . got following questions:

1) functions html content needs passed before insert , while output? 2) else filter function needed or there unused function?

thx in advance

function filter($data, $db) {     $data = $db->escape_string($data);     $data = htmlspecialchars($data, ent_ignore, 'utf-8');     $data = strip_tags($data);     $data = stripslashes($data);     $data = htmlentities($data);    return $data; }  function html($data, $db) {          $data = $db->escape_string($data);     return $data; } 

you should use escaping tool required medium, not anywhere.

to avoid sql injection, mysql_real_escape_string() is, @ minimun, need use. better alternative using prepared statements , paramerized queries (look pdo extension, shipped php since v 5.1 iirc), safest option avoid kind of exploit.

sending unescaped html db nothing, since malicious scripts aren't of course executed. hmtl needs sanitized on output, whenever you're going print out on page, , should done when needed, not a priori.

to secure html can use htmlentities(), minimum step. might want consider complex filters replace occurrencies of "bad" words , bad characters: more complex case requires long set of operations of course grant accurate level of security. can ask question topic, or search here on so.
strip_tags() might break markup (it won't html anymore, more plain text), besides not being in secure @ all.