title: Is it safe to use base64_encode instead of mysql_real_escape_string?
body: <p>I've been using <code>base64_encode</code> to preserve html from a <code>&lt;textarea&gt;</code> form and storing the data in the database.  Upon retrieval <code>base64_decode</code> is used and the data is put into the textarea. Is this safe to do without using <code>mysql_real_escape_string()</code>?</p>
  
  <p>I do I use <code>mysql_real_escape_string</code> when retrieving the <code>$_GET</code> parameter of template <code>id</code>.</p>
  
  <p><code>templates.php?id=4</code></p>
  
  <p>However using base64 to preserve the html also preserves any malicious sql code one might add in the textarea. I have not had any problems, so far.</p>
  
  <p>Is this bad practice to use base64 instead of <code>mysql_real_escape_string()</code>?</p>
  
  <p>"Wrong tool for the job" ?</p>
  
  <p><em>Note: I use <code>htmlspecialchars($text, ENT_QUOTES);</code> for xss.</em></p>