What best practices should PHP developers follow when allowing users to input and display formatted text on a website?

When allowing users to input and display formatted text on a website, PHP developers should sanitize user input to prevent cross-site scripting (XSS) attacks. This can be done by using functions like htmlspecialchars() to escape special characters. Additionally, developers should consider using a rich text editor that limits the types of formatting allowed to reduce the risk of malicious code being injected.

// Sanitize user input to prevent XSS attacks
$user_input = htmlspecialchars($_POST['user_input']);

// Display sanitized user input
echo $user_input;