Which is the better code to use?

Can anyone pleases tell me which one of theses pieces of code is actually better to use in the register.php?

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes($username)."'");

or

$getuser=$DB_site->query_first("SELECT username FROM user WHERE username='".addslashes(htmlspecialchars($username) )."'");

[DigitalDesktops]

the second one i believe

[filburt1]

If usernames are already htmlspecialchar'ed in the database, then the second one.

[Boofo]

Today at 05:32 PM filburt1 said this in Post #3
If usernames are already htmlspecialchar'ed in the database, then the second one.

Ok, how would I find out if they are?

[filburt1]

Register at your own forums using a username with a > in it, and then run these query:
[sql]
SELECT username FROM user WHERE username LIKE "%>%";
SELECT username FROM user WHERE username LIKE "%>%";
[/sql]

edit: of course vB is parsing the entities...

[Boofo]

Here's the db error I got that is the basis for this question.

Database error in vBulletin 2.2.9:

Invalid SQL: SELECT username FROM user WHERE username='Julie'34'
mysql error: You have an error in your SQL syntax near '34'' at line 1

mysql error number: 1064

Date: Monday 28th of April 2003 02:03:42 PM
Script: http://www.bearfacts2.com/forum/forum/register.php
Referer: http://www.bearfacts2.com/forum/regi...p?action=check