What are the best practices for handling user input validation and sanitization in PHP to prevent cross-site scripting (XSS) attacks?

To prevent cross-site scripting (XSS) attacks in PHP, it is crucial to validate and sanitize user input before displaying it on a webpage. This can be achieved by using functions like htmlspecialchars() to encode special characters and prevent them from being interpreted as HTML or JavaScript code. Additionally, using filter_input() or filter_var() functions with appropriate filters can help validate user input against expected formats.

$user_input = $_POST['user_input']; // Assuming user input is received via POST method

// Sanitize user input to prevent XSS attacks
$sanitized_input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');

// Validate user input against expected format
if (filter_var($sanitized_input, FILTER_VALIDATE_EMAIL)) {
    // Process the validated input
} else {
    // Handle invalid input
}