<p>I know I should be using htmlentities for all my form text input fields but this doesn't work:</p>

<pre><code>&lt;?php
echo "&lt;tr&gt;
        &lt;td align=\"right\"&gt;".Telephone." :&lt;/td&gt;    
        &lt;td&gt;&lt;input type=\"text\" name=\"telephone\" size=\"27\"
            value=\"htmlentities($row[telephone])\"&gt; Inc. dialing codes
        &lt;/td&gt;    
&lt;/tr&gt;";
?&gt;
</code></pre>

<p>It simply shows the input value as "htmlentities(0123456789)" in the form? What have I done wrong please?</p>

try using
```
```
value=\"" . htmlentities($row[telephone]) . "\"
```
```
there. Currently, your string simply contains the htmlentities string and splices the variable in. You need to get out the string, call the function and put it's result in place, as above.