title: Escape and sanitize $_GET parameters
body: <p>I know data should be sanitized when it is being outputted or displayed, NOT when it's being received or stored. This is what I'm doing now:</p>
  
  <pre><code>echo htmlspecialchars($name, ENT_QUOTES);
  </code></pre>
  
  <p>If I'm going to get the $_GET parameters and check the database for them, should I still sanitize and escape? For example:</p>
  
  <pre><code>$name = htmlspecialchars($_GET['name'], ENT_QUOTES);
  $stmt = $db-&gt;prepare("SELECT * FROM users WHERE name = :name");
  $stmt-&gt;bindParam(':name', $name);
  $stmt-&gt;execute();
  </code></pre>
  
  <p>So is <code>htmlspecialchars</code> needed or should I just do <code>$name = $_GET['name']</code>?</p>