Use PHP to build a Twitter-like system on your site

I don't think all code should have to come with a warning label.

I'm 17 years old, falling into your teen category, and there is no way I would ever run that code in a production environment - just by looking at it I can tell it's unfit.

I'll admit that I'm no PHP expert, but I was under the impression that htmlentities prevented XSS by converting all special html characters to their equivalent html entity.

If HTML entities works properly, and it is used properly, shouldn't it prevent XSS since an attacker who inputs something like <script>alert("xss")</script> would simply see the message displayed back to them instead of the browser actually executing it?

I personally think that both are valid methods to learn, but that you learn different things from going the separate ways. i.e. when I'm writing something from scratch I have to learn every little detail of what I'm trying to do, whereas taking a look at someone else's code I could gloss over a lot of the implementation details but learn how the author decided to implement some of the relevant/important parts, how to extend, and otherwise generally contribute to a project.