PHP Code optimisation - Best way to escape strings for SELECT queries to prevent javascript/XSS injection

Question

I want to know if the way I'm escaping quotes is the best or if it can be enhanced.

Visitors can submit text which is stored in database and then displayed in another page. Simple enough. I use PDO prepared statements to store in a database:

$sql = "INSERT INTO inscriptions (
            name,
            surname,
            comments
            )
            VALUES (
                :name,
                :surname,
                :comments
            )";     

$req = $db->prepare($sql);

$req->execute(array(
    ':name' => $name,
    ':surname' => $surname,
    ':comments' => $comments
));

This, I got it, it's the following part that cause me questionning:

Then to display it, I use htmlentities to prevent quotes and javascript to interfer with the code. I also use array_walk_recursive (or array_map depending on the case) to automise the escaping.

<?php function escaped(&$item)
{
    $item = htmlentities($item);
}

$sql = "SELECT *
        FROM master_table";
$req->execute(); 
$req = $db->prepare($sql);
while($row=$req->fetch()){
    array_walk_recursive($row, 'escaped'); ?>

    <p><?php echo $row["comments"]; ?></p>
    <form action="supp.php" method="post" onsubmit="return confirm('Do you want to delete <?php echo $row["surname"].' '.$row["name"]; ?> comment ?')">
        <input type="hidden" value="<?php echo $row["id"]; ?>" name="idcom" />
        <input type="image" alt="Delete" src="trash.png"/>
    </form>
    <?php } ?>

(This code is used to delete a comment with an alert before doing so, hence the importance of escaping because the name is used in the alert)

This code works fine, but I wanna if I'm doing escaping the right and secure way.

If something seems unclear in my post, please comment it so I can modify it.

Thanks !

Edit: Not asking about SQL Injection but Javascript, tag and quotes users could put on a field.