How can PHP developers prevent users from inputting HTML or JavaScript code that could affect the display of a website?

To prevent users from inputting HTML or JavaScript code that could affect the display of a website, PHP developers can use functions like htmlspecialchars() or strip_tags() to sanitize user input. These functions will convert special characters into their HTML entities or remove any HTML tags from the input, ensuring that the code is displayed as plain text and not executed as HTML or JavaScript.

$input = "<script>alert('XSS attack!');</script>";
$sanitized_input = htmlspecialchars($input);
echo $sanitized_input;