Hi Bill,

Thanks for reading my book! The issue with htmlspecialchars() (and I really should be using htmlentities() here) is that we're trying to escape all input from the user. This way, users can't add <script src="nastyscript.js"> and other things that would hijack your page. However, if you are displaying something that's already in HTML, then you do end up with the problem where you see the HTML markup on screen instead of it being a part of the HTML document.

You can dispense with htmlspecialchars/htmlentities on these fields IF you are properly filtering those fields BEFORE they get saved into the database. The method for doing this is in the book. In usual cases, you call bind() on your table object, then you go back and set the fields with HTML manually using the JRequest::getValue() function, passing in the appropriate parameters that allow "good" HTML through.