Which of the following functions can you use to mitigate a command injection attack? Each correct answer represents a complete solution. Choose all that apply.

escapeshellcmd() escapes shell metacharacters such as semicolons, pipes, redirects, and backticks within an entire command string, preventing attackers from injecting additional OS commands.

escapeshellarg() wraps a single argument in quotes and escapes any embedded quotes, ensuring user-supplied data is treated strictly as a literal argument and cannot break out of the intended command context.

htmlentities() converts HTML special characters to their entity equivalents, which prevents cross-site scripting (XSS) attacks against HTML output but does nothing to neutralize OS shell metacharacters used in command injection.

strip_tags() removes HTML and PHP tags from a string to prevent HTML injection or certain XSS vectors, but it does not address shell metacharacters and provides no protection against command injection.