What are the best practices for validating and sanitizing user input in PHP to prevent errors and security vulnerabilities?

Validating and sanitizing user input in PHP is crucial to prevent errors and security vulnerabilities such as SQL injection, cross-site scripting (XSS), and other forms of attacks. To validate user input, you can use functions like filter_var() to ensure that the input matches the expected format. To sanitize input, you can use functions like htmlspecialchars() to prevent XSS attacks by converting special characters to HTML entities.

// Validate and sanitize user input
$input = $_POST['user_input'];

// Validate input as an email address
if (filter_var($input, FILTER_VALIDATE_EMAIL)) {
    // Sanitize input to prevent XSS attacks
    $sanitized_input = htmlspecialchars($input);
    
    // Use the sanitized input in your application
    echo "Sanitized input: " . $sanitized_input;
} else {
    echo "Invalid email address";
}