Use esc_html() instead of htmlspecialchars() when appropriate

[scribu]

For all htmlspecialchars($string, ENT_QUOTES), we can safely use esc_html(), which is better.

[ryan]

Can we use esc_html() in wp-db.php? I'm not sure formatting.php is loaded for all situations.

[azaozz]

esc_html() is a display filter, main difference from htmlspecialchars() is that it doesn't double-encode some html entities and always encodes all quotes. However when loading text to edit double-encoding is usually needed.

[hakre]

There is no general rule that says esc_html() is better then htmlspecialchars. Using htmlspecialchars where appropriate is perfectly valid. It has less overhead for example and does a great job as well as it is properly tested.