Answer B is correct. Answer A is incorrect because this assumes that any username
without backticks or angled brackets is valid. Answer C is incorrect because this
only removes HTML and PHP tags, assuming everything else to be valid. Answer
D is incorrect because htmlentities() only encodes HTML entities and is not
intended to filter data at all.