Which of the following functions can you use to mitigate a command injection attack? Each correct answer represents a complete solution. Choose all that apply.

htmlentities() converts HTML special characters to their HTML entity equivalents to mitigate XSS in rendered output, but it does not escape shell metacharacters and provides no protection against command injection.

strip_tags() removes HTML and PHP tags from a string to reduce XSS risk, but it has no effect on the shell-level metacharacters that enable command injection attacks.

escapeshellarg() wraps user input in single quotes and escapes embedded single quotes, ensuring the input is treated as a single safe literal argument rather than being parsed as shell metacharacters or additional commands.

escapeshellcmd() escapes shell metacharacters such as semicolons, pipes, ampersands, and backticks within a command string, preventing attackers from appending or injecting additional OS commands.