title: Using htmlspecialchars within mysqli_stmt_bind_result()
body: <p>Can <code>htmlspecialchars</code> or <code>htmlentities</code> be used within <code>mysqli_stmt_bind_result</code>?</p>
  
  <pre><code>mysqli_stmt_bind_result($stmt,htmlspecialchars($var1));
  </code></pre>
  
  <p>Or better yet... If I am already using <code>htmlspecialchars</code> to echo form values, would inserting the validated values eliminate the need to use <code>htmlspecialchars</code> again in <code>mysqli_stmt_bind_param</code> before outputting onto page?</p>
  
  <pre><code>//if passes input validation from form...//
    $var1 = htmlentities($_POST['var1']);
  
  //in prepared statement, binding value to be used in page...//
  mysqli_stmt_bind_param($stmt,"s",$var1);
  </code></pre>