Prevent Cross-site scripting One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities:


htmlspecialchars()
strip_tags() 


What is Drupal 8 strategy to prevent XSS  attacks? How can I clean up client data post to protect my site from XSS attacks?

I remember Drupal 7 has filter_xss() to prevent XSS vulnerabilities, but what is Drupal 8 strategy against XSS vulnerabilities?
Sanitizing on output to avoid Cross Site Scripting (XSS) attacks
  
  Use Twig templates The Twig theme engine now auto escapes everything by default. That means that every string printed from a
  Twig template (e.g. anything between {{ }}) gets automatically
  sanitized if no filters are used.
  
  See Filters - Modifying Variables In Twig Templates for the Twig
  filters available in Drupal.
  
  In order to take advantage of Twig’s automatic escaping (and avoid
  safe markup being escaped) ideally all HTML should be outputted from
  Twig templates.
  
  API functions Use t() and \Drupal::translation()-&gt;formatPlural()
  with @ or % placeholders to construct safe, translatable strings. See
  Code text translation API in Drupal 8 for more details.
  
  
  Use Html::escape() for plain text.
  Use Xss::filter() for text that should allow some HTML tags.
  Use Xss::filterAdmin() for text entered by a admin users that should allow most HTML.
  
  
  Strings sanitized by t(), Html::escape(), Xss::filter() or
  Xss::filterAdmin() are automatically marked safe, as are markup
  strings created from render arrays via Renderer.
  
  While it can also sanitize text, it's almost never correct to use
  check_markup in a theme or module except in the context of something
  like a text area with an associated text format.


Source: Drupal 8: Writing secure code by: Rade, Shyamala, Robert Castelo, and Pere Orga.