Are there any best practices or resources for avoiding cross-site scripting vulnerabilities in PHP?

Cross-site scripting (XSS) vulnerabilities can be avoided in PHP by properly sanitizing user input and outputting data securely. One common way to prevent XSS attacks is to use functions like htmlspecialchars() or htmlentities() to escape potentially malicious input before displaying it to the user.

// Sanitize user input before outputting to prevent XSS attacks
$user_input = "<script>alert('XSS attack!');</script>";
$sanitized_input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

echo $sanitized_input;