security - How to escape output in PHP

Question

I am a newbie, just to be clear. I hear a lot about escaping data to prevent XSS attacks. How do I actually do that?

This is what I am doing currently -

$s = mysqli_real_escape_string($connect,$_POST['name']));

Is this enough? Thanks

Answer 1

If you output the data to html you should use htmlspecialchars() else, if you're storing the data in a database you should escape strings using mysqli_real_escape_string() and cast numbers (or use prepared statements for both) and protect identifiers/operators by whitelist-based filtering whem.

Both these methods are all you need if you use them the correct way.