title: Is preventing XSS and SQL Injection as easy as does this
body: <p><strong>Question</strong>: Is preventing <strong>XSS</strong> (cross-site scripting) as simple using <code>strip_tags</code> on any saved input fields and running <code>htmlspecialchars</code> on any displayed output ... and preventing <strong>SQL Injection</strong> by using PHP PDO prepared statements?</p>
  
  <p>Here's an example:</p>
  
  <pre><code>// INPUT: Input a persons favorite color and save to database
  // this should prevent SQL injection ( by using prepared statement)
  // and help prevent XSS  (by using strip_tags)
  $sql = 'INSERT INTO TABLE favorite (person_name, color) VALUES (?,?)';
  $sth = $conn-&gt;prepare($sql);
  $sth-&gt;execute(array(strip_tags($_POST['person_name']), strip_tags($_POST['color'])));
  
  
  // OUTPUT: Output a persons favorite color from the database
  // this should prevent XSS (by using htmlspecialchars) when displaying
  $sql = 'SELECT color FROM favorite WHERE person_name = ?';
  $sth = $conn-&gt;prepare($sql);
  $sth-&gt;execute(array(strip_tags($_POST['person_name'])));
  $sth-&gt;setFetchMode(PDO::FETCH_BOTH);
  while($color = $sth-&gt;fetch()){
    echo htmlspecialchars($color, ENT_QUOTES, 'UTF-8');
  }
  </code></pre>