Surfing the web I find two approaches on storing data in databases.
Store data in the database with the html-specialcharacters sanitized
$userdata = $_POST['field']; store_in_db_via_PDO(htmlspecialchars($userdata), 'field'); display_on_page(get_from_db('field'));
Store data as raw as possible in database and sanitize on display:
$userdata = $_POST['field']; $store_in_db_via_PDO($userdata, 'field'); display_on_page(htmlspecialchars('field'));
BTW I'm not speaking about sqlinjection atacks, these are 'caught` by the PDO-driver
Is there an industry standard on storing data, which shouldn't include html-code, in a database?