First, read up about these in the Drupal API:

- [filter_xss](https://api.drupal.org/api/drupal/includes!common.inc/function/filter_xss/7)
- [check_plain](https://api.drupal.org/api/drupal/includes!bootstrap.inc/function/check_plain/7)

So `check_plain()` encodes special characters that has special meaning in HTML (such as `<` and `&`) into plain text entities (i.e. `&lt;` and `&amp;` respectively) that will make these be rendered literally (not interpreted as HTML) when that string that is then displayed as part of a page with HTML-markup. The function `filter_xss()` filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. It does four things:

  - Removing characters and constructs that can trick browsers
  - Making sure all HTML entities are well-formed
  - Making sure all HTML tags and attributes are well-formed
  - Making sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:)

Both functions are used to sanitize data from users to make sure that any user injection is neutralized before the data is *rendered* on your site.  

You never pass the *same string* through *both*.

If you use `check_plain()` then the string passed to the function is supposed to be used as *plain text* (not HTML). Then `filter_xss()` is not needed, since `check_plain()` will always make the string plain text.

If you use `filter_xss()`, then the string passed to the function is supposed to be HTML, and `check_plain()` will mess it up.

When I look at the template you use as example, it looks to me as if all three fields passed to `print()` comes from content that is already sanitized, and need no more sanitation.

However, if you create your *own module* that collects user input without passing it through a "safe" text filter such as "Filtered HTML" or "Plain", you must use these functions for sanitation purposes.