title: Do I need htmlentities() or htmlspecialchars() in prepared statements?
body: <p>In an article <a href="http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html" rel="noreferrer">http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html</a>, it says the followings:</p>
  <blockquote>
  <p>There are numerous advantages to using prepared statements in your applications, both for <em><strong>security</strong></em> and performance reasons.</p>
  <p>Prepared statements can help increase security by separating SQL logic from the data being supplied. This separation of logic and data can help prevent a very common type of vulnerability called an SQL injection attack.</p>
  <p>Normally when you are dealing with an ad hoc query, you need to be very careful when handling the data that you received from the user. <em><strong>This entails using functions that escape all of the necessary trouble characters, such as the single quote, double quote, and backslash characters.</strong></em></p>
  <p><em><strong>This is unnecessary when dealing with prepared statements</strong></em>. The separation of the data allows MySQL to automatically take into account these characters and they do not need to be escaped using any special function.</p>
  </blockquote>
  <p>Does this mean I don't need <code>htmlentities()</code> or <code>htmlspecialchars()</code>?
  But I assume I need to add <code>strip_tags()</code> to user input data?
  Am I right?</p>