How can one ensure that user input does not lead to the execution of arbitrary PHP code?

To ensure that user input does not lead to the execution of arbitrary PHP code, it is important to validate and sanitize all user input before using it in any PHP code execution. This can be done by using functions like htmlspecialchars() to escape special characters and prevent code injection. Additionally, limiting the use of eval() function and avoiding dynamic execution of user input can also help mitigate the risk of executing arbitrary PHP code.

$user_input = $_POST['user_input'];

// Sanitize user input using htmlspecialchars
$sanitized_input = htmlspecialchars($user_input);

// Use the sanitized input in your PHP code
echo "User input: " . $sanitized_input;