What are the best practices for handling user input validation and sanitization in PHP login scripts to prevent security vulnerabilities?

User input validation and sanitization are crucial in PHP login scripts to prevent security vulnerabilities such as SQL injection and cross-site scripting attacks. To handle this, always validate user input to ensure it meets the expected format and sanitize it to remove any potentially harmful characters or code. This can be done using PHP functions like filter_var() for validation and htmlentities() or mysqli_real_escape_string() for sanitization.

// Validate and sanitize user input for a login form
$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
$password = filter_var($_POST['password'], FILTER_SANITIZE_STRING);

// Validate email input
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

// Sanitize input to prevent SQL injection
$username = mysqli_real_escape_string($conn, $username);
$password = mysqli_real_escape_string($conn, $password);
$email = mysqli_real_escape_string($conn, $email);