Is check_plain() enough? Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
I imagine the question is about using check_plain(filter_xss($string)), or filter_xss(check_plain($string)).

check_plain() and filter_xss() have two different, and in contrast, purposes:


check_plain() encodes special characters in a plain-text string that is then displayed as HTML.
filter_xss() filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. In particular its purpose is:


Removing characters and constructs that can trick browsers
Making sure all HTML entities are well-formed
Making sure all HTML tags and attributes are well-formed
Making sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:)



If you use check_plain(), the string passed to the function is supposed to be used as plain text; in such case, filter_xss() is not necessary.
If you use filter_xss(), then the string passed to the function is supposed to be HTML, and check_plain() is not necessary.

If the question is about using check_plain() and filter_xss() on different parts of the same string then, as greggles pointed out in his comment, you can use (for example) check_plain() on the content of tag attributes, and filter_xss() on the entire HTML tag.