Although many sources quote the htmlspecialchars
function with ENT_QUOTES
to be not enough to prevent SQL injection, none of them provide a proof of the concept. I cannot think of any possibility myself.
Let us consider the following example:
$username = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
$sql = "SELECT * from user WHERE name='$username'";
mysql_query($sql,...);
Can any one provide an example, OTHER than ones covered by the case when SQL injection gets around mysql_real_escape_string()?
htmlspecialchars
function is for escaping characters that have special meaning to a browser, such as angle brackets, to make them appear as normal characters instead of being interpreted as HTML markup. It has nothing to do with SQL or preventing SQL injection. – Wyzard Mar 1 '14 at 16:57