title: Is htmlspecialchars enough to prevent an SQL injection on a variable enclosed in single quotes?
body: <p>Although many sources quote the <code>htmlspecialchars</code> function with <code>ENT_QUOTES</code> to be <strong>not</strong> enough to prevent SQL injection, none of them provide a proof of the concept. I cannot think of any possibility myself.</p>
  
  <p>Let us consider the following example:</p>
  
  <pre><code>$username = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
  $sql = "SELECT * from user WHERE name='$username'";
  mysql_query($sql,...);
  </code></pre>
  
  <p>Can any one provide an example, OTHER than ones covered by the case when <a href="https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string">SQL injection gets around mysql_real_escape_string()</a>? </p>