Filter input, escape output

It prevents using output you might not to be used (echo'd for example).

Let's say you would want to retrieve a name value from a GET parameter. Someone might instead set Javascript code as the name value, like: http://yourwebsitedomain.nl/?name=<script>alert('Evil stuff');</script>

If you simply echo out the value without escaping, the Javascript code gets executed. So you don't want to do this:

<?php
echo $_GET['name'];  

This code might do evil things, you wan't to prevent that of course. So instead we make sure no code is being echo'd by escaping the output, like this:

<?php
echo filter_input( INPUT_GET,  'name', FILTER_SANITIZE_STRING ); // strip code from string

Here is a good link that helps explain output escaping.

https://benramsey.com/articles/escape-output/

Hi im not sure of the difference between filtering input and escaping output - if you filter input from a user e.g. PHP filter_input and display it in a forum surely you don't need to also escape using htmlentities()? isnt it the same thing?