How can PHP developers efficiently handle user input validation and sanitization to prevent common vulnerabilities like SQL injection and cross-site scripting (XSS)?

To prevent common vulnerabilities like SQL injection and cross-site scripting (XSS), PHP developers can efficiently handle user input validation and sanitization by using prepared statements for database queries and utilizing functions like htmlspecialchars() to sanitize user input before displaying it on a webpage.

// Example of using prepared statements to prevent SQL injection
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->bindParam(':username', $_POST['username']);
$stmt->execute();
```

```php
// Example of sanitizing user input to prevent XSS
$clean_input = htmlspecialchars($_POST['input']);
echo $clean_input;