htmlentities is sufficient to protect your site and your visitors as long as you don't do anything overtly ignorant in the process. For example, let's say you output the message like this:
<div class="post"><?php echo htmlentities($myVar, ENT_QUOTES); ?></div> ...
<script><?php echo htmlentities($myVar, ENT_QUOTES); ?></script>
<?php eval($myVar); ?>
Preventing XSS isn't just about escaping output, it's about knowing when to escape output, and in which contexts it might be dangerous. You should never emit user input within a script, style, base or link tag, and you should always sanitize user input before putting it anywhere in the body or head tag or any of its children, and especially in attributes, which is common when you're pre-populating forms (e.g. so they can correct invalid input).
Even the site you linked to contains basically what I just said, but less verbose:
HTML entity encoding is okay for untrusted data that you put in the body of the HTML document, such as inside a tag. It even sort of works for untrusted data that goes into attributes, particularly if you're religious about using quotes around your attributes. But HTML entity encoding doesn't work if you're putting untrusted data inside a tag anywhere, or an event handler attribute like onmouseover, or inside CSS, or in a URL. So even if you use an HTML entity encoding method everywhere, you are still most likely vulnerable to XSS. You MUST use the escape syntax for the part of the HTML document you're putting untrusted data into. That's what the rules below are all about.