How to accept only certain special characters while accepting a location address in PHP?

Question

I want to accept an address of a place and enter it into my database. If I send the address as a parameter to the following function it would remove all initial and end spaces along with all special characters

 public function sanitizeString($string){
        $sanitized_string = htmlentities(mysqli_real_escape_string($this->conn, trim($string)));
        return $sanitized_string;
    }

But as we know in addresses like

1/A Grand Trunk Road, Kolkata - 31

there are a few special characters like '/', '-', ',' which has to be accounted for.

I basically want to store the address of certain places in my database and convert them to latitudes and longitudes using Google Maps GeoCoding API and use markers to mark them on a Google Map.

Can anyone suggest me a way on how to sanitize the address keeping certain special characters intact or some other way to store addresses of places ?

EDIT

For those asking, I do use PDO prepared statements when dealing with database queries. Here is an instance

public function getUserByEmailAndPassword($email, $password){
        $stmt= $this->conn->prepare("select * from users where email= ? and status=1");
        $stmt->bind_param("s", $email);

        if($stmt->execute()){
            $user= $stmt->get_result()->fetch_assoc();
            $stmt->close();
            return $user;
        }
        else{
            return NULL;
        }
    }

But before I pass the $email as a parameter, I am sanitizing it using mysqli_real_escape_string which I probably do not need to do, because prepare and bind_param takes care of sql injection I think.

Answer 1

As a general rule, when using PDO, you don't try to sanitize the values WHEN INSERTING into the database. We have prepared statements and parameter binding options to prevent sql injection

Now when you actually use the information stored in the database (which could contain malicious code), you always use the function htmlspecialchars() when you echo anything. For example:

//if you obtained the info from your database as follows:
$row = $stmt->fetch();

//then you can output it as follows:
echo htmlspecialchars($row['address']);

and your code will be protected both for sql injection (if you used prepared statements and binding parameters when inserting the information initially into the datbase) and for XSS with the function htmlspecialchars()