title: Why I don't have to re-escape form data on SELECT again?
body: <p>For my simple application where I chose to write my own solution for blog comments, I'm doing these 3 steps:</p>
  
  <p><strong>1. Taking data from basic HTML form inputs</strong> via POST, then escaping the strings like this:</p>
  
  <pre><code>$komentar = htmlspecialchars($_POST['komentar'], ENT_QUOTES, 'UTF-8');
  </code></pre>
  
  <p><strong>2. Using PDO</strong> for db insertion:</p>
  
  <pre><code>$stmt = $conn-&gt;prepare("INSERT INTO komentare (id, jmeno, komentar, clanek) VALUES (DEFAULT, ?, ?, ?)");
      $stmt-&gt;bind_param("sss", $jmeno, $komentar, $clanek);
      $stmt-&gt;execute();
      $stmt-&gt;close();
      $conn-&gt;close();
  </code></pre>
  
  <p><strong>3. Listing the results back</strong> using plain SELECT and loop-echoing like this:</p>
  
  <pre><code>$sql = "SELECT jmeno, komentar FROM komentare WHERE clanek = '$clanek' ORDER BY id DESC";
    $result = $conn-&gt;query($sql);
    if ($result-&gt;num_rows &gt; 0) {
        while($row = $result-&gt;fetch_assoc()) {
            $zviratkoNum = rand(1,10);
            $vypis_jmeno = $row["jmeno"];
            $vypis_komentar = $row["komentar"];
            echo "&lt;div class='radek'&gt;&lt;span class='jmeno zviratka-". $zviratkoNum ."'&gt;". $vypis_jmeno. "&lt;/span&gt;&lt;span class='komentar'&gt;" . $row["komentar"] . "&lt;/span&gt;&lt;/div&gt;";
        }
    } else {
        echo "&lt;h5&gt;Zatím zde nejsou žádné komentáře&lt;/h5&gt;";
    }
    $conn-&gt;close();
  </code></pre>
  
  <hr>
  
  <p>I thought it's a bad practice because while I escape the input (hopefully properly), I'm retrieving data back not escaped. But to my surprise, it get's echo'ed into DOM as a text (screenshot from my real test comment):</p>
  
  <p><a href="https://i.stack.imgur.com/Ck4JD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ck4JD.png" alt="enter image description here"></a></p>
  
  <ol>
  <li>Why?</li>
  <li>Is it bad practice?</li>
  </ol>
  
  <p>Thanks in advance, Adam</p>