What are the best practices for handling HTML content in PHP when storing and retrieving data from a database?

When storing HTML content in a database using PHP, it is important to properly sanitize the input to prevent SQL injection attacks and cross-site scripting vulnerabilities. One common approach is to use the htmlspecialchars() function to escape special characters in the HTML content before storing it in the database. When retrieving the data from the database, you can use the htmlspecialchars_decode() function to decode the HTML content and display it properly on the webpage.

// Sanitize HTML content before storing in the database
$htmlContent = htmlspecialchars($htmlContent, ENT_QUOTES);

// Store the sanitized HTML content in the database
$query = "INSERT INTO table_name (html_content) VALUES ('$htmlContent')";
// Execute the query

// Retrieve HTML content from the database and decode it before displaying
$query = "SELECT html_content FROM table_name WHERE id = $id";
// Execute the query
$result = // Fetch the result

$decodedHtmlContent = htmlspecialchars_decode($result['html_content']);
echo $decodedHtmlContent;