SQL injection occurs when untrusted input is concatenated into SQL queries; it's prevented using prepared statements with bound parameters instead of string interpolation. Cross-site scripting (XSS) occurs when untrusted input is rendered as HTML without escaping.
Use htmlspecialchars() (or a templating engine's auto-escaping) when outputting user-supplied data into HTML to prevent XSS, and always validate/whitelist input on the server side regardless of client-side checks.