Filtering input for security

So I am trying to make my website more secure. Is using htmlspecialchars and htmlentities enough? And should I filter output or just input?