How to prevent XSS attacks

phpbb used to do this, but I don't think it does anymore. The problem is that some users have ISPs that transparently route their web access through rotating HTTP proxies, all with different IP addresses. So, each click has the potential for sending the user through a different IP, and invalidating their session. AOL was infamous for this practice. You can imagine this might also happen closer to the client, say within a corporate network.

I would not recommend showing a user's password for security reasons. If you do show it thought, then using xss_clean would probably complicate things as it probably removes or escapes some special chars like <, > and &.

You would never have to filter a password. In general, you shouldn't rely on filtering, but rather on escaping. Escaping always work, whereas filtering can have subtle edge cases. The only place where you should resort to filtering, is when you (for some reason) need to display input as code. But it's important to stress that filtering is less safe than escaping - it's not the other way around. That's counter-intuitive, so a lot of people get it wrong.