call htmlspecialchars $val=…[;$flags=…[;$encoding=…[;$double_encoding=…]]]
$flags=ENT_QUOTES (single quotes are converted) will probably be the only setting used
$encoding =... will probably not be required
for other options for flags and encoding settings see htmlspecialchars on php.net
$double_encode=0 do not re encode existing html entities (default is to encode everything)