Using htmlentities & entquotes in sqli injection : Why do many people use htmlentities &  ENT_QUOTES? The following code is a sample from one of the most viewed SQLI/PHP CRUD who teaches people. What is he trying to do? What is the purpose? Is it something worth studying for an hour or two? I am assuming it is not trying [https://stackoverflow.com/questions/4809608/how-to-prevent-sql-injection][1] (which can be found in that link). Thanks.    

 

    $firstname = htmlentities($_POST['firstname'], ENT_QUOTES);
    $lastname = htmlentities($_POST['lastname'], ENT_QUOTES);
    if ($stmt = $mysqli->prepare("UPDATE players SET firstname = ?, lastname = ?
    WHERE id=?"))
    {
    $stmt->bind_param("ssi", $firstname, $lastname, $id);
    $stmt->execute();
    $stmt->close();
    }


  [1]: https://stackoverflow.com/questions/4809608/how-to-prevent-sql-injection