When i just started coding i was looking at WordPress check what they did to prevent from XSS and read a lot about bugs inside WordPress its the fastest way to learn. WordPress did a good work and there's a lot of tutorials on each filter ,function ,class they made until now.