htmlspecialchars()

all string and smallint inputs passed through htmlspecialchars()