What are the best practices for handling user input validation and sanitization in PHP?

User input validation and sanitization are crucial in PHP to prevent security vulnerabilities such as SQL injection, cross-site scripting (XSS), and other malicious attacks. Best practices include using functions like filter_input() for input validation, using prepared statements for database queries, escaping user input with functions like htmlentities(), and validating input against expected formats using regular expressions.

// Example of input validation and sanitization in PHP
$user_input = $_POST['user_input']; // Assuming user input is coming from a POST request

// Validate user input using filter_input()
if (filter_input(INPUT_POST, 'user_input', FILTER_VALIDATE_EMAIL)) {
    // Sanitize user input using htmlentities()
    $sanitized_input = htmlentities($user_input);
    
    // Use the sanitized input in your application
    echo "Sanitized input: " . $sanitized_input;
} else {
    echo "Invalid input";
}