What do you do with html injections?

[eluser]PhilTem[/eluser]
That's the easiest method. But be careful with htmlentities' arguments. If you have set your pages' and datbase's charset to UTF-8 then you will get strange output from htmlentities since

If omitted, the default value for this argument is ISO-8859-1 in versions of PHP prior to 5.4.0, and UTF-8 from PHP 5.4.0 onwards

(from php.net)