php - Todo list methods to prevent xss attack, which are the most efficient?

I would love to know which best methods/tips do we have to use to prevent and make difficult a xss attack ?

I know there are :

What's about users who need to complete a database?
What kind of mistakes usually can do a new developer?

Thank you