title: Is it good to use htmlspecialchars() before Inserting into MySQL?
body: <p>I am a little confused on this. I have been reading about <code>htmlspecialchars()</code> and I am planning to use this for the textareas <code>POST</code> to prevent XSS attack. I understand that usually <code>htmlspecialchars()</code> are used to generate the HTML output that is sent to the browser. But what I am not sure is:</p>
  
  <p>1) Is it a safe practice to use <code>htmlspecialchars()</code> to the user input data before I insert it into MySQL? I am already using PDO prepared statement with parameterized values to prevent SQL Injection.</p>
  
  <p>2) Or, I really dont need to worry about using <code>htmlspecialchars()</code> to inserted values (provided they are parameterized) and only use <code>htmlspecialchars()</code> when I fetch results from MySQL and display it to users?</p>