title: Should I escape characters in my GET and POST requests?
body: <p>I have just read that PHP escapes incoming GET and POST requests on its own for some time. Double escaping does no good. Should I escape the strings at all?</p>
  
  <p>For example I process a simple input like this:</p>
  
  <pre><code>$contact = mysqli_real_escape_string($dbLink, strip_tags($_POST['contact']));
  </code></pre>
  
  <p>Later, when saved and retrieved from the database I fill the input with last values, like:</p>
  
  <pre><code>echo '&lt;input type="text" class="form-control" id="inputContact" name="contact" value="'.$contact.'"&gt;'.PHP_EOL;
  </code></pre>
  
  <p>When someone enters quotes in the field, it returns something like this, which destroys the form:</p>
  
  <pre><code>&lt;input type="text" class="form-control" id="inputContact" name="contact" value="0900 123 456, jozefmat" ejkasdfadsf"=""&gt;
  </code></pre>