Try It Yourself - SyntaxStudy Editor

HTML / CSS / JS

<?php
// htmlspecialchars — THE primary XSS defence for HTML output
$userInput = '<script>alert("XSS")</script>';
echo htmlspecialchars($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');
// &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

// strip_tags — remove all tags (dangerous: leaves JS in attributes)
$dirty = '<p>Hello <b>World</b> <script>alert(1)</script></p>';
echo strip_tags($dirty);               // Hello World alert(1) — NOT safe enough alone!
echo strip_tags($dirty, ['<p>','<b>']); // Allow only <p> and <b>

// filter_var sanitization
$email  = filter_var('  user@example.com  ', FILTER_SANITIZE_EMAIL);
$url    = filter_var('https://exam ple.com', FILTER_SANITIZE_URL);
$int    = filter_var('42abc', FILTER_SANITIZE_NUMBER_INT); // "42"

// filter_var validation (returns false on failure)
$validEmail = filter_var($email, FILTER_VALIDATE_EMAIL);
$validUrl   = filter_var($url,   FILTER_VALIDATE_URL);
$validInt   = filter_var('42',   FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 100]
]);

var_dump($validEmail); // string or false
var_dump($validInt);   // "42" or false