now im confused... (making user input safe)

[eluser]oddman[/eluser]
XSS I'm fairly certain (but don't quote me on this) stands for cross-site scripting. What that means is, you don't want variables you can put in a form or via a URL being output to a page, unless it's protected from this sort of attack. Basically all you really have to do is encode all html entities, which I'm pretty sure xss_clean does. So no, for saving data you don't have to do that - but for output, you absolutely should - when the data is from an insecure source. Also, if you don't clean your data before input (ie. you allow all sorts of characters), you need to be very careful with outputting that data.

Hope that helps.