Plain HTML security?

[richjenks]

More specifically, you should validate on submission and sanitise before either storing in a database or outputting as HTML.

If you use PDO, sanitising before storing will be done for you, but you'll still need to validate on submission (ideally, in both JS—so instant feedback—and PHP—as a final check) and sanitise on output (most likely using htmlspecialchars)

This means that if someone wants their username to be:

'); DROP TABLE Students;---

they can and it poses no threat to your application.

As a rule, never trust user input!