Should htmlspecialchars() be used with bindParams in PHP when working with user inputs?

When working with user inputs in PHP, it is important to sanitize the data to prevent any potential security vulnerabilities such as cross-site scripting (XSS) attacks. While using bindParams in prepared statements helps prevent SQL injection, it does not automatically handle HTML special characters. Therefore, it is recommended to use htmlspecialchars() in conjunction with bindParams to escape special characters in user inputs before storing or displaying them.

// Example code snippet using bindParams and htmlspecialchars to sanitize user input
$userInput = $_POST['user_input'];

// Prepare a SQL query with a placeholder
$stmt = $pdo->prepare("INSERT INTO table_name (column_name) VALUES (:user_input)");

// Bind the sanitized user input using bindParams
$stmt->bindParam(':user_input', htmlspecialchars($userInput));

// Execute the statement
$stmt->execute();