What are the differences between using mysqli_real_escape_string and htmlspecialchars in PHP for data security?

When dealing with user input in PHP, it is important to sanitize the data to prevent SQL injection attacks and cross-site scripting (XSS) attacks. mysqli_real_escape_string is used to escape special characters in a string for use in an SQL statement, helping to prevent SQL injection attacks. htmlspecialchars, on the other hand, is used to convert special characters to HTML entities, preventing XSS attacks by ensuring that user input is displayed as plain text rather than interpreted as HTML. To ensure data security, it is recommended to use mysqli_real_escape_string when inserting user input into a database and htmlspecialchars when displaying user input on a webpage.

// Using mysqli_real_escape_string for database input
$input = mysqli_real_escape_string($connection, $_POST['input']);

// Using htmlspecialchars for displaying input on a webpage
echo htmlspecialchars($input);