title: The use of htmlspecialchars() or htmlentities() in prepared statements
body: <p>I am using prepared statements to store, retrieve and update data to or from the database. Do I need to use htmlspecialchars() or htmlentities() if I am using prepared statements? </p>
  
  <p>From what I understand, you dont need to use htmlspecialchars() when inserting data and it only concerns html that is outputted...</p>
  
  <p>I have a situation where I am using a prepared statement to store user input from a register form like so:</p>
  
  <pre><code>$stmt = $conn2-&gt;prepare("INSERT INTO users (username, email, password) VALUES (?, ?, ?)");
  $stmt-&gt;bind_param('sss', $username, $email, $password);
  $stmt-&gt;execute();
  </code></pre>
  
  <p>I have another script that is retrieving the username and password when logging in and displaying their username on screen like so:</p>
  
  <pre><code>$stmt = $conn2-&gt;prepare("SELECT username FROM users WHERE username = ? AND password = ?");
  $stmt-&gt;bind_param("ss", $username, $password);
  $stmt-&gt;execute();
  $stmt-&gt;store_result();
  
  if ($stmt-&gt;num_rows == 1) {
  
  $stmt-&gt;bind_result($name);
  $stmt-&gt;fetch();
  </code></pre>
  
  <p>I have also put the username in a SESSION and echoed the session like so:</p>
  
  <pre><code>echo $_SESSION['user']['username']
  </code></pre>
  
  <p>From this example, do I need to use htmlspecialchars() or htmlentities() when displaying the username? Is this what is meant by outputting the HTML?</p>
  
  <p>If so, where would I implement htmlspecialchars() or htmlentities()??</p>