Here\'s my problem:
I have a textarea where the user can enter whatever he wants.
When he sends this text (POST method), on the server side I don\'t filter it
When outputting surely you'd be better just using strip_tags and setting "a" to be an allowable element?
I.e.
$string = strip_tags($string,'');
This would remove the tags instead of converting them to their entities though. It depends if you need it to convert everything apart from tags into entities, or if you just want to remove the code.