You must encode special characters!
<?php 
$bad = '<script>alert("boo!")</script>';
$ok = htmlspecialchars($bad,ENT_QUOTES); // < > & " ' 
print "Alert...$bad";
print $ok;
?>
Output
Alert...<script>alert("boo!")</script>