What are the potential pitfalls of not properly encoding HTML content in PHP variables before outputting them?

The potential pitfalls of not properly encoding HTML content in PHP variables before outputting them include leaving the application vulnerable to cross-site scripting (XSS) attacks. To prevent this, it is essential to use functions like htmlspecialchars() to encode the HTML content before displaying it on the webpage.

// Example of properly encoding HTML content in PHP variables before outputting them
$unsafe_content = "<script>alert('XSS attack!')</script>";
$safe_content = htmlspecialchars($unsafe_content);

echo $safe_content;