title: Is using htmlspecialchars() for input/output HTML sanitization, for MySQL database bad design?
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/3126072/what-are-the-best-php-input-sanitizing-functions">What are the best PHP input sanitizing functions?</a>  </p>
  </blockquote>
  
  
  
  <p>Is using htmlspecialchars() for input/output HTML sanitization, for MySQL database bad design?</p>
  
  <p>Should you instead just not allow these "dangerous" signs because it still will show b-tags,i-tags and others? And how to do so?</p>
  
  <p>I'm asking because it says on wiki <a href="http://en.wikipedia.org/wiki/HTML_sanitization" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/HTML_sanitization</a> </p>
  
  <p>"HTML sanitization can be used to protect against cross-site scripting and SQL injection attacks by sanitizing any HTML code submitted by a user."</p>
  
  <p>So besides using PDO prepared statements, to prevent SQL-injections, i want to use this htmlspecialchars for all input and output. But maybe I should use something else?</p>
  
  <p>Is this a good way to do an insert statement for instance?:</p>
  
  <pre><code>$type= htmlspecialchars($_POST['animaltype']);
  $name= htmlspecialchars($_POST['animalname']);
  $age= htmlspecialchars($_POST['animalage']);        
  $descr= htmlspecialchars($_POST['animaldescription']);
  $foto= htmlspecialchars($_POST['animalfotourl']);
  $date=htmlspecialchars($_POST['animalhomelessdate']);
  
  
  
  $sqlquery  = "INSERT INTO animals_tbl(animaltype, animalname, animalage, animaldescription, animalfotourl, animalhomelesssince) VALUES (':type',':name',':age',':descr', ':foto', ':date')";
  
  
  $stmt = $conn-&gt;prepare($sqlquery);
  $stmt-&gt;bindParam(':type',$type, PDO::PARAM_STR);
  $stmt-&gt;bindParam(':name',$name, PDO::PARAM_STR);
  $stmt-&gt;bindParam(':age',$age, PDO::PARAM_INT);
  $stmt-&gt;bindParam(':descr',$descr, PDO::PARAM_STR);
  $stmt-&gt;bindParam(':foto',$foto, PDO::PARAM_STR);
  $stmt-&gt;bindParam(':date',$date, PDO::PARAM_STR);
  
  $stmt-&gt;execute();
  </code></pre>