What are common pitfalls when using pre-defined values in PHP input fields?

Common pitfalls when using pre-defined values in PHP input fields include not properly sanitizing user input, leaving the input vulnerable to cross-site scripting attacks. To solve this issue, always use htmlspecialchars() function to escape special characters before displaying user input in input fields.

<input type="text" name="username" value="<?php echo htmlspecialchars($username); ?>">