First, what htmlspecialchars() and similar functions do isn't escaping dangerous code, it's encoding data as HTML.
So, what htmlspecialchars does not do is the following:
- Receive data
- Find dangerous HTML code and replace this by harmless code
- Return the sanitized data
But it does the following:
- Receive data
- Convert this data to HTML, so that when this code is displayed it will look the same as when the original data would be viewed without being parsed by an HTML parser.
- Return the HTML code
➥ You can see the difference here
Additionally, since you're asking this, you may be misunderstanding where XSS prevention should be applied. Encoding data as HTML shouldn't be done when it is received, but when it is outputted by the web server.
So, you should not be doing it like this:
- Server receives data from a client
- Server escapes the data as HTML
- Server processes the data
- Server outputs the data to the client
But like this:
- Server receives data from a client
- Server processes the data
- Server escapes the data as HTML
- Server outputs the data to the client