Protect against XSS with .htaccess file
The common definition of XSS is that code faults which allow someone to manipulate your website appearance, access prohibited sections of data, view inaccessible files or possibly steal credentials and cheat your app's users into entering data on the wrong website.

One of the most commonly used XSS vulnerabilities is what we call "free input" when the app allows users to insert HTML or javascript into a form which using POST or GET HTTP methods.

The reason why XSS exists is not sanitizing user free input, allowing someone to inject code into your form which can lead to injecting remote javascript which can write the data you enter into the app database and stealing your information.

A very common method to do this is for phishing purposes to steal login credentials and account information.

To prevent script injections and attempts to modify your PHP’s global and request variables, use the following in your .htaccess:

&lt;IfModule mod_rewrite.c&gt;
RewriteCond %{QUERY_STRING} (\&lt;|%3C).*script.*(\&gt;|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* index.php [F,L]
&lt;/IfModule&gt;


You may use this free online XSS scanner to ensure the cleanness of your pages, http://xss-scanner.com/ and don't forget to use mod_security which would help reduce this kind of attacks.

By the way, you never trust user provided data inputs which include $_POST, $_GET, file uploads, cookies and HTTP headers (like User-Agent and Referer) such data must always be treated as untrusted and needs to be secured for each context especially if you're going to insert these inputs to your database.

Here is a very useful article including tips and tricks of .htaccess 
http://viralpatel.net/blogs/21-very-useful-htaccess-tips-tricks/