What are the best practices for displaying database values containing special characters in PHP, especially when dealing with HTML output?

When displaying database values containing special characters in PHP for HTML output, it is important to properly sanitize the data to prevent any potential security vulnerabilities like cross-site scripting (XSS) attacks. One common method to achieve this is by using the htmlspecialchars() function in PHP, which converts special characters to their corresponding HTML entities. This ensures that the special characters are displayed correctly on the webpage without causing any unintended effects.

// Retrieve data from the database
$data = $row['column_name'];

// Sanitize the data before displaying it on the webpage
echo htmlspecialchars($data, ENT_QUOTES, 'UTF-8');