There is no need for double encode, but single quotes should be encoded.

[`htmlentities()`](http://php.net/htmlentities) encodes everything [`htmlspecialchars()`](http://php.net/htmlspecialchars) does, but more.

The double encode would make all signs that are special html chars `>` `<` `"` `&` unreadable, but does not provide anything securitywise.