htmlentities or htmlspecialchars or stripslashes? Which one to use?

Question

When i insert user input data into the mysql database i use, mysql_real_escape_string. The input data contains bbcode e.g. [img][/img].

Below is a line for when the html is output.

    $information = $this->bbcode(stripslashes($this->swearfilter($row['information'])),1);
   echo $information;

Regarding this example, is this the correct way to prevent a XSS attack or do i use htmlspecialchars($var,ENT_QUOTES) or htmlentities?

Answer 1

$message = preg_replace('#\[img\](.*?)\[/img\]#', '<img src="$1" />', $message);  

Prevent XSS Attacks

Answer 2

use htmlspecialchars() to prevent XSS attack