How can SQL injection and XSS vulnerabilities be prevented in PHP code?

SQL injection vulnerabilities can be prevented in PHP code by using prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This helps to separate the SQL code from the user input, preventing malicious input from altering the SQL query's structure. XSS vulnerabilities can be prevented in PHP code by properly sanitizing and escaping user input before outputting it to the browser. This can be done using functions like htmlspecialchars() or htmlentities() to encode special characters in the user input, preventing them from being interpreted as HTML or JavaScript code. Example PHP code snippet for preventing SQL injection using prepared statements:

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement using a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the query parameters
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();
```

Example PHP code snippet for preventing XSS vulnerabilities by sanitizing user input:

```php
// Sanitize user input before outputting it to the browser
echo htmlspecialchars($_POST['input'], ENT_QUOTES, 'UTF-8');