PHP is there a built-in function to render ' as ’ etc

Answer 1

Try htmlentities():

htmlentities("'", ENT_QUOTES, 'UTF-8', true);

Regarding your second question, yes (as a general rule).

To output user input / raw input you should always use htmlspecialchars() at least.

Answer 2

You're looking for htmlentities(). It will translate any character that has a HTML character entity equivalent.

It is not unsafe to output raw characters in your HTML, although there are a couple of caveats to that:

• It could produce invalid HTML if you are outputting them inside document entities or attributes.
• If it is user input, then it needs to be sanitized to prevent possible cross-site scripting (XSS) attacks.