1) If you use prepared statements to insert your data, you do not need to escape quotes and other special characters within it. Basically, you are protected against SQL injection. However, you still need to sanitize the data so that it contains no XSS attacks. You are on the right track for this, as you're looking into HTML Purifier. Also, you need to write business logic code to validate your data to make sure that it is indeed what you're expecting (type-checking, range checking, etc.).
2) In theory, you should sanitize the data before you display to the user and HTML purifier can do this task. In practice, however, you will notice that HTML purifier is a pretty heavy library and therefore not well suited to be used every time the data is displayed. A better-performing solution is to run HTML purifier on the data before it is inserted into the database, then display it without extra validation. You are essentially trying to ensure that your database is clean, because if the database is clean then whatever comes from there will definitely be clean as well. This is also a good approach for security in general.
Your validation procedure should be something like:
if( ! isValid( $rawData ) ) {
return;
}
$purifiedData = htmlPurifier( $rawData );
mysql_prepared_insert( $purifiedData );
Of course, this is only one way to do it. There are many approaches to good security and sanitizing data. Also, it is important that you understand why you would use HTML Purifier. You should use it when you want to allow your users to post some HTML tags, but not all. If you want to block all HTML, then the htmlspecialchars function will do the trick in a much more efficient way. HTML purifier is good when you have a whitelist of tags that you want to allow and block everything else. You can also use it to strip down all tags instead of escaping them, therefore making the text look slightly better than after it goes through htmlspecialchars.
