You MUST escape user output! When printing data to the page, wrap it in `htmlspecialchars($content, ENT_QUOTES, 'UTF-8')`. Never trust user input to be safe HTML.