In the provided code, what best practice should be implemented to prevent XSS attacks in form inputs?

To prevent XSS attacks in form inputs, a best practice is to sanitize user input by using functions like htmlspecialchars() or htmlentities() before displaying the input on the webpage. This will encode special characters in the input, making it safe to display without executing any malicious scripts. By implementing this sanitization step, you can protect your website from potential XSS vulnerabilities.

// Sanitize user input before displaying it on the webpage
$user_input = $_POST['user_input']; // Assuming 'user_input' is the form input field

$sanitized_input = htmlspecialchars($user_input);

echo $sanitized_input; // Display the sanitized input on the webpage