mysql_real_escape_string , htmlspecialchars mistake?
<p>I know <code>htmlspecialchars</code> is for html output and <code>mysql_real_escape_string</code> is for insert for the database.  I'm not sure how to apply in this scenario.  For example</p>

<pre><code>$search = mysql_real_escape_string(htmlspecialchars($_GET['search'],ENT_QUOTES));

mysql_query("INSERT INTO table1 VALUES ('','$search')",$this-&gt;connect);

echo "&lt;a href='http://www.example.com/$search'&gt;$search&lt;/a&gt;";
</code></pre>

<p>Do i have to seperate the top line so <code>mysql_real_escape_string</code> is before the insert and <code>htmlspecialchars</code> is after?  I'm hoping i don't have to otherwise i have to go over alot of code..  </p>

<p>Also would using <code>htmlspecialchars</code> twice do anything different then once?  I'm sure somewhere in my code i have used <code>htmlspecialchars</code> twice on the same variable.</p>

<p>e.g.</p>

<pre><code>$var = htmlspecialchars($one); //top of page

$var2 = htmlspecialchars($var); //another function
</code></pre>
