How can the use of "exec" and "shell_exec" functions in PHP lead to security vulnerabilities?

The use of "exec" and "shell_exec" functions in PHP can lead to security vulnerabilities because they allow for the execution of shell commands on the server. This can potentially open up the server to command injection attacks if user input is not properly sanitized. To mitigate this risk, it is recommended to use alternative methods such as "proc_open" or "escapeshellarg" to safely execute shell commands.

$command = escapeshellarg($user_input);
$output = shell_exec("ls " . $command);
echo $output;