How safe?

Question

PHP

I use PDO (bindParam) and filter all data through filter_var() FILTER_SANITIZE_NUMBER_INT or FILTER_SANITIZE_STRING .
Is this enough for security? Isn't it required to additionally do htmlspecialchars, for example?

Answer 1

Enough, all is well. By the way, PDO can do it too.
htmlspecialchars should only be used when outputting data to the browser, when it may contain content sent by the user (untrusted content), or in other cases when you need to escape the output.

Answer 2

I always make my own regex filter for peace of mind: you never know?!

Answer 3

and I filter all data through filter_var() FILTER_SANITIZE_NUMBER_INT or FILTER_SANITIZE_STRING.

It is pointless.
No "protection" is needed if you use PDO correctly.