Question

To avoid SQL injection and XSS we use the function htmlspecialchars() or others like escapeString.

If we have to use this function every time that we construct a SQL query and get the results, why then the function

$results->fecthArray(); 

doesn’t apply the function htmlspecialchars directly?

Answer 1

Injection attacks happen when there is a change in the programming/instruction language. Example, from PHP to SQL, you need mysqli_real_escape_string to escape the query string before processing by the SQL server.

To answer your question, $results still remains as a PHP variable and you only need to do the escaping just prior to outputting on the HTML form. Most people don’t do that straight away and some may not even output to HTML, so the function does not need to apply htmlspecialchars automatically.