zhhealthcare/openemr — comment on commit 432b99d5f3f0a2373c192354b7a6e05b7d39c7c4
File: interface/logview/erx_logview.php line 68
By bradymiller:

No, sorry I wasn't clear; shouldn't run it through this function twice. Meant:

Note, this is much simpler than it seems. The ENT_QUOTES flag will also encode the ', while the ENT_NOQUOTES doesn't. So, the safest thing is to always use ENT_QUOTES:
http://php.net/manual/en/function.htmlspecialchars.php