I have a script that registers users based on their user input. This uses prepared statements plus whitelists to prevent sql injection. But I am struggling to understand the prevention of XSS.

From what I understand, you only need to prevent XSS if you are outputting HTML onto the page? What does this mean???

Im guessing that with this register page it doesn't apply because I am not outputting HTML to the web page? Is that right?

If I was to prevent XSS, do I use htmlspecialchars?