How can the htmlentities() function be effectively used to prevent XSS attacks while still allowing for the inclusion of HTML and CSS formatting in PHP-generated content?

To prevent XSS attacks while still allowing HTML and CSS formatting in PHP-generated content, the htmlentities() function can be used to encode special characters in the output. This function converts characters like <, >, ", ', and & into their respective HTML entities, which will prevent them from being interpreted as code by the browser. By using htmlentities() on user-generated content before displaying it on the webpage, you can ensure that any potential malicious scripts are neutralized.

// Example of using htmlentities() to prevent XSS attacks while allowing HTML and CSS formatting
$user_input = "<script>alert('XSS attack!')</script>";
$safe_output = htmlentities($user_input);
echo "<div style='color: red;'>$safe_output</div>";