What are the potential pitfalls of not properly encoding or escaping GET variables in PHP when constructing URLs?

Not properly encoding or escaping GET variables in PHP when constructing URLs can lead to security vulnerabilities such as SQL injection attacks or Cross-Site Scripting (XSS) attacks. To prevent this, it is important to always properly encode or escape any user input that is included in URLs.

// Example of properly encoding GET variables in PHP
$unsafe_input = $_GET['input']; // Unsafe input from GET variable
$safe_input = urlencode($unsafe_input); // Encoding the unsafe input

// Constructing a URL with the safe input
$url = "http://example.com/page.php?input=" . $safe_input;