title: Htmlentities vs addslashes vs mysqli_real_escape_string
body: <p>I've been doing some reading on securing PHP applications, and it seems to me that <code>mysqli_real_escape_string</code> is the correct function to use when inserting data into MySQL tables because <code>addslashes</code> can cause some weird things to happen for a smart attacker. Right?</p>
  
  <p>However, there is one thing that is confusing me. I seem to remember being advised <code>addslashes</code> is better than <code>htmlentities</code> when echoing user-entered data back to users to protect their data, but it seems like <code>addslashes</code> is the one with the vulnerability. Is this true, or am I remembering incorrectly?</p>