How to check the form for submitting messages from a site on XSS injection?

Question

PHP

I have a form for sending messages from the site to my email.
Any user can write a message and send it.
The form is being submitted via php

<form enctype="multipart/form-data" method="post" id="form" action="send.php">

After sending - pressing the button, it redirects to a new page on which it says thank you.

If you insert it into the form, <script>alert('aa');</script>or <script>alert(document.cookie)</script>it will stupidly send this whole thing to me by mail (although the fields will be empty in the incoming message).

I don’t know how to try to perform a similar output to the screen of JS code in it, it immediately sends everything on click.

Answer 1

https://www.php.net/manual/en/function.htmlentities.php