How can the use of mysqli_real_escape_string() and htmlspecialchars() functions improve the security and readability of PHP code that generates HTML?

When generating HTML content dynamically in PHP, it is important to sanitize user input to prevent SQL injection attacks and Cross-Site Scripting (XSS) vulnerabilities. Using the mysqli_real_escape_string() function helps prevent SQL injection by escaping special characters in input data before sending it to the database. Additionally, using the htmlspecialchars() function helps prevent XSS attacks by converting special characters to their HTML entities, ensuring that user input is displayed as text and not executed as code.

// Sanitize user input using mysqli_real_escape_string() and htmlspecialchars()
$user_input = $_POST['user_input']; // Example user input from a form

// Sanitize user input to prevent SQL injection
$user_input_safe = mysqli_real_escape_string($connection, $user_input);

// Sanitize user input to prevent XSS attacks
$user_input_safe_html = htmlspecialchars($user_input_safe);

// Display the sanitized input in HTML
echo "<p>" . $user_input_safe_html . "</p>";