What best practices should be followed when handling user input in PHP scripts?

When handling user input in PHP scripts, it is important to sanitize and validate the input to prevent security vulnerabilities such as SQL injection and cross-site scripting attacks. One best practice is to use functions like htmlentities() or mysqli_real_escape_string() to sanitize user input before using it in database queries. Additionally, validating user input against expected formats or ranges can help ensure the data is safe and accurate.

// Sanitize user input using htmlentities()
$user_input = htmlentities($_POST['user_input']);

// Validate user input against expected format
if(preg_match("/^[a-zA-Z0-9]+$/", $user_input)) {
    // Input is valid, proceed with processing
} else {
    // Display error message or handle invalid input
}