php - Do I need htmlentities() or htmlspecialchars() in prepared statements? -

in article http://dev.mysql.com/tech-resources/articles/4.1/prepared-statements.html, says followings:

there numerous advantages using prepared statements in applications, both security , performance reasons.

prepared statements can increase security separating sql logic data being supplied. separation of logic , data can prevent common type of vulnerability called sql injection attack.

normally when dealing ad hoc query, need careful when handling data received user. this entails using functions escape of necessary trouble characters, such single quote, double quote, , backslash characters.

this unnecessary when dealing prepared statements. separation of data allows mysql automatically take account these characters , not need escaped using special function.

does mean don't need htmlentities() or htmlspecialchars()? assume need add strip_tags() user input data? right?

htmlentities , htmlspecialchars used generate html output sent browser.

prepared statements used generate/send queries database engine.

both allow escaping of data; don't escape same usage.
so, no, prepared statements (for sql queries) don't prevent using htmlspecialchars/htmlentities (for html generation)

about strip_tags: remove tags string, htmlspecialchars transform them html entities.
2 functions don't same thing; should choose 1 use depending on needs / want get.

for instance, piece of code:

$str = 'this <strong>test</strong>'; var_dump(strip_tags($str)); var_dump(htmlspecialchars($str)); 

you'll kind of output:

string 'this test' (length=14) string 'this <strong>test</strong>' (length=43) 

in first case, no tag; in second, escaped ones.

and, html output:

$str = 'this <strong>test</strong>'; echo strip_tags($str); echo '<br />'; echo htmlspecialchars($str); 

you'll get:

this test <strong>test</strong> 

which 1 of want? that important question ;-)