php htmlspecialchars is not enough to prevent an xss attack

xss-atack.php

<h1>php htmlspecialchars()</h1>
<h3>without END_QUOTES flag is an xss attack possible:</h3>
<?php
echo "<a href='" . htmlspecialchars("'onmouseover='a()'") . "'>link</a><br/>";
echo "<textarea style='overflow: none;  width: 350px; border: none; resize: none; line-break: none;'>";
echo "<a href=''onmouseover='a()''>link</a>";
echo "</textarea><br/>";

echo "<a href='" . htmlspecialchars("'onmouseover='alert(123)'") . "'>link</a><br/>";
echo "<textarea style='overflow: none;  width: 350px; border: none; resize: none; line-break: none;'>";
echo "<a href=''onmouseover='alert(123)''>link</a>";
echo "</textarea>";
?>

<h3>use the END_QUOTES flag for more security:</h3>
<?php
echo "<a href='" . htmlspecialchars("'onmouseover='a()'", ENT_QUOTES) . "'>link</a><br/>";
echo "<textarea style='overflow: none;  width: 350px; border: none; resize: none; line-break: none;'>";
echo "<a href='&#039;onmouseover=&#039;a()&#039;'>link</a>";
echo "</textarea>";
?>

<script>function a() {alert('xss: execute internal function !');}</script>