How to prevent XSS attacks

How can we prevent XSS attacks? my comment function cannot prevent '> script alert (document. cookie) script
= '> Script alert (document. cookie) script
This type of code attacks, but it doesn't matter if I look at the CSDN Forum. what should I do to prevent such character attacks like the forum?

If there is no way, how can I write code if I only accept Chinese characters (in upper and lower cases), numbers, punctuation marks, and other characters used to write common articles?

Thank you!

Reply to discussion (solution)

Use the htmlspecialchars function to filter comments.

You can use PDO ~~

Forgive me for being dull. If I have the following code structure:
$ Bid = $ _ POST ['bid']
...
$ SQL = insert into "abc" ('bid') values ($ bid )....



How can I use filter? For example, how do I use the input name = bid and htmlspecialchars functions I submitted?
In addition, I learned how to use this function? Http://www.w3school.com.cn/php/func_string_htmlspecialchars.asp.pdf converts a predefined entity to an HTML entity. I don't think the characters have changed? What does this mean?
& (And number) become &
"(Double quotation marks)"
'(Single quotes)'
<(Less than) becomes <
> (Greater than) become>

Also, if the conversion happens, my understanding is that the conversion is displayed in the database. why is the style and content displayed on the page the original user input? Do you still need to parse a code or something?