How can htmlspecialchars be used to prevent HTML tags from being rendered in PHP output?

When rendering user input in PHP output, it is important to prevent HTML tags from being interpreted as actual HTML and potentially causing security vulnerabilities like cross-site scripting (XSS) attacks. One way to do this is by using the htmlspecialchars function in PHP, which converts special characters like < and > into their HTML entity equivalents, preventing them from being rendered as HTML tags.

$userInput = "<script>alert('XSS attack!')</script>";
echo htmlspecialchars($userInput);