Answers for "php prevent xss and sql injection"

How can I prevent SQL injection in PHP?

//Connect
$unsafe_variable = $_POST["user-input"];
$safe_variable = mysql_real_escape_string($unsafe_variable);

mysql_query("INSERT INTO table (column) VALUES ('" . $safe_variable . "')");
//Disconnect

prevent xss php

echo htmlspecialchars($string_to_display, ENT_QUOTES, 'UTF-8');