What are the potential pitfalls of manipulating output in PHP?

Manipulating output in PHP can lead to security vulnerabilities such as Cross-Site Scripting (XSS) attacks if user input is not properly sanitized. To prevent this, always sanitize any user input before outputting it to the browser. Use functions like htmlspecialchars() to escape special characters and prevent malicious scripts from being executed.

$userInput = "<script>alert('XSS attack!');</script>";
echo htmlspecialchars($userInput);