prep_for_form vs htmlentities

[eluser]sszynrae[/eluser]
maybe this interests you:
1. enabling global xss filtering automatically runs converts html entities on insert.
2. html_entity_decode() reverses the effect so your html gets read.
3. whatever the validation rule does, it does not convert &<>