Are there any potential pitfalls to be aware of when trying to display a message during script processing in PHP?

One potential pitfall when trying to display a message during script processing in PHP is forgetting to properly escape the message content, which can lead to security vulnerabilities like cross-site scripting (XSS) attacks. To prevent this, always use functions like htmlspecialchars() to escape any user input before displaying it on the page.

$message = "<script>alert('Hello, World!');</script>";
echo htmlspecialchars($message);