title: do I even need `htmlspecialchars()` for textarea's value
body: <p>I have <code>staff.php</code> page which contains staff's name,position and detail.When user would need to edit staff info,they would be send to <code>edit.php</code> page.<code>edit.php</code> page show name and title on <code>text field</code> and detail on a <code>textarea</code></p>
  
  <p>My question is,do I even need <code>htmlspecialchars</code> in <code>edit.php</code> page.I am not printing anything to users page,only on that fields.But I'm using <code>htmlspecialchars</code> on <code>staff.php</code> before printing to user.</p>
  
  <p>Is it still open to <code>XSS Attack</code>?</p>
  
  <p><strong>Code</strong></p>
  
  <p><em>part from <code>staff.php</code></em></p>
  
  <pre><code>$staff.="&lt;div id='sob'&gt;".htmlspecialchars($title)."&lt;br&gt;".htmlspecialchars($sub_title)."&lt;div&gt;&lt;a href='edit.php?pid=".htmlspecialchars($pro_id)."'&gt;&lt;input type='submit' id='editx' name='editx' value='Edit'&gt;&lt;/a&gt;&lt;/div&gt;&lt;div id=''&gt;&lt;br&gt;".htmlspecialchars($detail)."&lt;/div&gt;&lt;hr id='h'&gt;&lt;/div&gt;";
  </code></pre>
  
  <p><em>part from <code>edit.php</code></em></p>
  
  <pre><code>if(isset($_GET["pid"])){
    $name4=$title;            //
    $sub_title4=$sub_title;   //using prepared statement  
    $detail4=$detail;         //
    }
  
    HTML part at edit.php
  
   &lt;input type='text' id='staff_name' name='staff_name' value="&lt;?php echo $name4;?&gt;" required&gt;
   &lt;/br&gt;&lt;input type='text' id='staff_pos' name='staff_pos' value="&lt;?php echo $sub_title4;?&gt;" required&gt;
   &lt;/br&gt;&lt;textarea id='staff_detail' name='staff_detail' cols='30' rows='6'  required&gt;&lt;?php echo $detail4;?&gt;&lt;/textarea&gt;&lt;/br&gt;
  </code></pre>