MySQL html special chars record problem

[eluser]prototype20[/eluser]
Hi Guys!

I have a big problem.

I write this in into input field: <h1> or whatever html special character,
gets into the mysql so:

Code:

& l t ; h1 & g t ;

(without spaces).

Why?!

My View file:

Code:

<?php header('Content-Type: text/html; charset=utf-8'); ?>
<div id="baltartalom">
&lt;?php
echo '<h2>Új képes bejegyzés</h2>';

if (isset($error_message_stack) && count($error_message_stack) >= 1){
    echo '<div class="errorDiv">
    
            <p><span>Hiba a létrehozás során</span><br />A következő<em>(ke)</em>t cseszted el:</p>
            <ul>
                ' . $error_message_stack . '
            </ul>
            <p><strong>Rábasztál! Nem csináltunk neked képes bejegyzést!</strong></p>
        </div>';
}

if (isset($confirmation_message)){
    echo $confirmation_message;
}
echo '<div id="form">
        &lt;form action="' . htmlentities(current_url()) . '" method="post"&gt;
            <div class="form-row">
                <label id="name_label" for="name_input">Cím</label>
                &lt;input class="belepes" id="name_input" type="text" maxlength="40" name="cim"'; echo (isset($cim) && $cim != '') ? " value='" . htmlentities($cim) . "' /&gt;" : " />"; echo '
                &lt;input type="hidden" name="createtoken"'; echo (isset($token) && $token != '') ? " value='" . htmlentities($token) . "' /&gt;" : " />"; echo '
            </div>
            <div class="form-row">
                <label id="password_label" for="password_input">Bevezető</label>
                &lt;input class="belepes" id="password_input" type="text" name="bevezeto"'; echo (isset($bevezeto) && $bevezeto != '') ? " value='" . htmlentities($bevezeto) . "' /&gt;" : " />"; echo '
            </div>
            <div class="form-row">
                <label id="email_label" for="email_input">Részletes</label>
                &lt;input class="belepes" id="email_input" type="text" minlength="40" name="reszletes"'; echo (isset($reszletes) && $reszletes != '') ? " value='" . htmlentities($reszletes) . "' /&gt;" : " />"; echo '
   </div>
            
            
            <div id="form_button">
                &lt;input class="belepes" id="submit_button" type="submit" name="submit" value="Bejegyzés létrehozása" /&gt;
            </div>
        &lt;/form&gt;
    </div>
';

mysql character set: utf - 8 unicode
collation: utf8 general ci

php file: utf-8 without bom

sorry for my bad english, please help me!

[eluser]danmontgomery[/eluser]

Code:

htmlentities($bevezeto)

I would guess you're running xss_filter on form validation, too (or have global xss filtering enabled)