<p>I have PHP configured so that magic quotes are on and register globals are off.</p>

<p>I do my best to always call htmlentities() for anything I am outputing that is derived from user input.</p>

<p>I also occasionally seach my database for common things used in xss attached such as...</p>

<pre><code>&lt;script
</code></pre>

<p>What else should I be doing and how can I make sure that the things I am trying to do are <strong>always</strong> done.</p>

Escaping all user input is enough for most sites. Also make sure that session IDs don't end up in the URL so they can't be stolen from the
```
Referer
```
link to another site. Additionally, if you allow your users to submit links, make sure no
```
javascript:
```
protocol links are allowed; these would execute a script as soon as the user clicks on the link.