What are the potential issues with directly outputting PHP values in HTML forms?

Directly outputting PHP values in HTML forms can lead to security vulnerabilities such as cross-site scripting (XSS) attacks. To prevent this, it is recommended to properly sanitize and escape the PHP values before outputting them in the HTML form. This can be done using functions like htmlspecialchars() to encode special characters and prevent malicious code injection.

<input type="text" name="username" value="<?php echo htmlspecialchars($username); ?>">