What are some potential pitfalls to avoid when using echo statements in PHP?

One potential pitfall to avoid when using echo statements in PHP is directly outputting user input without proper sanitization, which can lead to cross-site scripting vulnerabilities. To prevent this, always sanitize user input using functions like htmlspecialchars() before echoing it.

$userInput = "<script>alert('XSS attack!');</script>";
echo htmlspecialchars($userInput);