Should htmlspecialchars() be used for capturing HTML inputs and mysql_real_escape_string() for writing to the database in PHP?

When capturing HTML inputs in PHP, it is recommended to use htmlspecialchars() to prevent XSS attacks by converting special characters to their HTML entities. When writing data to a MySQL database, it is important to use mysql_real_escape_string() to escape special characters and prevent SQL injection attacks. 

// Capture HTML inputs using htmlspecialchars()
$clean_input = htmlspecialchars($_POST['input']);

// Write data to database using mysql_real_escape_string()
$escaped_data = mysql_real_escape_string($clean_input);
$query = "INSERT INTO table_name (column_name) VALUES ('$escaped_data')";

Keywords

htmlspecialchars mysql_real_escape_string HTML inputs database PHP

Related Questions