What are some potential pitfalls when using PHP to handle form submissions, such as feedback messages in a popup window?

One potential pitfall when using PHP to handle form submissions for feedback messages in a popup window is not properly sanitizing user input, which can leave your application vulnerable to cross-site scripting attacks. To solve this issue, always use PHP functions like htmlspecialchars() to escape user input before displaying it on the page.

// Sanitize user input before displaying in a popup window
$user_feedback = htmlspecialchars($_POST['feedback']);
echo "<script>alert('$user_feedback');</script>";