Difference between htmlspecialchars and mysqli_real_escape_string?

Question

I read in a PHP book that it is recommended to use htmlspecialcharsalso mysqli_real_escape_stringin conditions when we process the data entered by the user. What is the main difference between the two and where are they suitable for use? Please guide me.

Answer 1

htmlspecialchars: "<" "& lt;" (Replaces HTML)

mysqli_real_escape_string: "to \" (Replaces the code that makes sense in the mysql query)

Both are used to protect against certain attacks such as SQL-Injection and XSS.

Answer 2

These two functions are used for completely different things.

htmlspecialchars() HTML- , . mysql_real_escape_string() SQL, SQL.

, htmlspecialchars OUTPUT, mysql_real_escape_string INPUT.

Answer 3

; , -.

mysqli_real_escape_string SQL-.

htmlspecialchars (XSS).

. PHP? htmlspecialchars mysql_real_escape_string PHP ?

Answer 4

htmlspecialcharacters "html " , , ( , ), /, . , -, HTML- XSS.

mysql_real_escape_string escapes string, , \ , ( , ) , mysql. , SQL .

Answer 5

, - - PHP , , PHP, CakePHP CodeIgniter, ?