What are some common pitfalls to avoid when outputting HTML using PHP?

One common pitfall to avoid when outputting HTML using PHP is not properly escaping user input, which can lead to cross-site scripting (XSS) attacks. To prevent this, always use htmlspecialchars() or htmlentities() to encode user input before outputting it to the browser.

$userInput = "<script>alert('XSS attack!');</script>";
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');