Question

For example if i use $id= $_GET['id']; and then i use that $id as a condition for an if statement, do i have to use htmlspecialchars on $id?

e.g.

$id = htmlspecialchars($_GET['id']);

if($id) {
//code
}

Is htmlspecialchars needed, even though no html is being output?

Answer 1

No. You only need to HTML-escape data if you are outputting it into an HTML context, and the data may contain characters which have a special meaning in HTML (e.g. <, >, ") and you do not want those characters to break your HTML structure.

Also see The Great Escapism (Or: What You Need To Know To Work With Text Within Text).