What are the best practices for avoiding xss attacks in a PHP site

Question

I have PHP configured so that magic quotes are on and register globals are off.

I do my best to always call htmlentities() for anything I am outputing that is derive

Answer 1

You should at least validate all data going into the database. And try to validate all data leaving the database too.

mysql_real_escape_string is good to prevent SQL injection, but XSS is trickier. You should preg_match, stip_tags, or htmlentities where possible!