Is the train of thought correct?

Question

PHP

There is a field (let's say a comment on the site), it can contain html code and should be displayed as html code. Is it enough to wrap the output of this field in tags <code></code>or not, to protect against XSS?
Thanks in advance for your reply!

Answer 1

Not enough. Check it out for yourself by entering the following code on your website:
use this library - htmlpurifier.org , it's quite simple.

Answer 2

Any normal CMS validates inputs, especially user comments. There are standard functions in PHP that allow you to convert the characters "/<:;{ etc. to unicode.
PS As my teacher said - "Write a program so that a fool does not accidentally break it."

Answer 3

If you do not use user input, then you do not need to protect yourself from anything.
If used and HTML is not allowed then htmlspecialchars()
If used but HTML is allowed then htmlpurifier.org