What are the potential pitfalls of not properly escaping or formatting strings in PHP echo statements?

Not properly escaping or formatting strings in PHP echo statements can lead to security vulnerabilities such as cross-site scripting (XSS) attacks where malicious scripts can be injected and executed on the client-side. To prevent this, it is important to properly escape any user input or dynamic content before outputting it using the htmlspecialchars() function to encode special characters.

// Example of properly escaping user input in PHP echo statement
$userInput = "<script>alert('XSS attack!')</script>";
echo htmlspecialchars($userInput);