Escape a customer name when rendering HTML, not when storing it

A customer called A & B Supplies should retain that exact name in the database. Saving A & B Supplies mixes presentation rules into the data. Later, a JSON response contains HTML entities and a Blade template may escape the value again.

Store the value; encode the output

<?php
$name = 'A & B <Supplies>';
$html = htmlspecialchars($name, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
assert($html === 'A &amp; B &lt;Supplies&gt;');
assert($name === 'A & B <Supplies>');

In Blade, ordinary {{ $name }} output performs HTML escaping. Avoid switching to raw {!! !!} output to fix double encoding. Correct the earlier storage or transformation problem instead.

The destination determines the encoding

HTML text, a URL parameter, a JavaScript value, and a SQL parameter are different contexts. HTML escaping is not a substitute for parameterized SQL. It also does not validate the scheme of a link: an escaped javascript: URL remains an unsuitable destination. Validate the allowed URL schemes separately.

A rich-text editor needs a deliberate sanitization policy because some HTML is intended. That policy belongs to the rich-text content type, not to every customer name in the system. Do not apply a blanket raw-output exception across the page.

Check names containing ampersands, both quote types, angle brackets, and non-ASCII characters. Verify both the visible page and the underlying stored value. A successful test should show readable text without creating an unexpected element in the document.

Reference

Official documentation. The examples here illustrate the stated boundary; adapt them to your application and test its failure paths.