What are the differences between escaping data for HTML output and escaping data for SQL queries in PHP, and why is it important to distinguish between the two?

When escaping data for HTML output in PHP, special characters like <, >, and & should be converted to their respective HTML entities to prevent XSS attacks. On the other hand, when escaping data for SQL queries, special characters like ' and " should be properly escaped to prevent SQL injection attacks. It's important to distinguish between the two because the escaping mechanisms are different for HTML and SQL, and using the wrong method can leave your application vulnerable to security risks.

// Escaping data for HTML output
$htmlOutput = "<script>alert('XSS attack!');</script>";
$escapedHtmlOutput = htmlspecialchars($htmlOutput, ENT_QUOTES, 'UTF-8');
echo $escapedHtmlOutput;

// Escaping data for SQL queries
$sqlInput = "John's SQL injection attempt";
$escapedSqlInput = mysqli_real_escape_string($connection, $sqlInput);
$sqlQuery = "INSERT INTO users (name) VALUES ('$escapedSqlInput')";
mysqli_query($connection, $sqlQuery);