Security, htmlentities question

Question

I've been reading about how htmlentities is supposed to convert special characters into harmless versions when used with inserts and updates, etc.
So, I tested an insert form of mine with a script that redirects to an example.com site. (I found the script in the tut on tizag.com for htmlentities). Anyway, bad news is the injection attack worked like a charm, the code was inserted into my database with script tags intact and when I went to load my site page it redirected me to the malicious site. Bummer.
The htmlentities is inside the standard edit form action of the DW CS3 update rsb:
$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
with the form action set thus:
<form action="<?php echo $editFormAction; ?>"
So, that's bad. What do I do now to understand why it failed, and fix it.
Thanks in advance.

Answer 1

hmm... okay but what about an attack like this that won't be prevented by stripslashes
<script type='text/javascript'>
window.location = 'http://www.example.com/'
</script>
I put that into my database and it worked like the attacker wanted. What do I do to prevent those?
I wrote this, but it's long-winded:
<?php
$specChar = array('/',':','*','?','<','>','|','#','{','}','%','~','&','\\','"','\'');
$specChar2 = array('' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,'' ,''  ,'&quot;','&#39;');
if(isset($_POST['BookTitle']) && !empty($_POST['BookTitle'])) {$_POST['BookTitle'] = str_replace($specChar,$specChar2,$_POST['BookTitle']);}?>
All of my questions come from my sudden confusion at having turned off get_magic_quotes_gpc, if that is any guide to your counsel.
Thanks Murray.
Worried & Confused in WorriFused land