title: Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
body: <p>Earlier today a question was asked regarding <a href="https://stackoverflow.com/questions/110458/what-percentage-of-my-time-will-be-spent-in-user-input-verfication-during-web-d">input validation strategies in web apps</a>.</p>
  
  <p>The top answer, at time of writing, suggests in <code>PHP</code> just using <code>htmlspecialchars</code> and <code>mysql_real_escape_string</code>. </p>
  
  <p>My question is: Is this always enough? Is there more we should know? Where do these functions break down?</p>