What are the best practices for avoiding xss attacks in a PHP site

Question

I have PHP configured so that magic quotes are on and register globals are off.

I do my best to always call htmlentities() for anything I am outputing that is derive

Answer 1

I find that using this function helps to strip out a lot of possible xss attacks: http://www.codebelay.com/killxss.phps