Basic data sanitization

<form method="post" action="">
Enter some HTML:
<br>
<input type="text" name="html">
<br>
<input type="submit" value="Submit">
</form>
<div>
  You entered:
    <?= htmlspecialchars($_POST["html"]) ?> <!--Use htmlspecialchars() function to transform HTML elements into HTML entities (characters that represent HTML elements but won’t display as HTML). This is to prevent a man-in-the-middle attack for malicious HTML -->
</div>