Why This Is Secure

• ✅ User input is sanitized using htmlspecialchars().
• 🛡️ Pattern matching prevents common XSS tags like <script>, <iframe>, and inline events.
• 🧼 Input is never rendered raw into the DOM, blocking payload execution.

Common Injection Attempts

• <script>alert('XSS Attack!')</script>
• <img src=x onerror='alert(1)'>
• <a href='https://malicious.com'>Click here</a>
• <iframe src='https://evil.com'></iframe>
• <script>document.body.style.background='pink'</script>

Result: All of these are blocked or encoded, so no malicious code is executed.