How can PHP be used to effectively format input to display HTML entities in the browser view?

When displaying user input on a webpage, it is important to format it properly to prevent any HTML or JavaScript injection attacks. One way to achieve this is by using PHP's htmlspecialchars function to convert special characters to HTML entities. This ensures that the input is displayed as plain text on the webpage, without being interpreted as HTML code.

$user_input = "<script>alert('XSS attack!');</script>";
$clean_input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');
echo $clean_input;