What are the potential risks of not properly sanitizing or escaping data before displaying it on a webpage in PHP?

If data is not properly sanitized or escaped before displaying it on a webpage in PHP, it can leave your website vulnerable to cross-site scripting (XSS) attacks. This can allow malicious users to inject scripts into your webpage, potentially stealing sensitive information or compromising the security of your website. To prevent this, always sanitize and escape user input before displaying it on a webpage. You can use functions like htmlspecialchars() or htmlentities() to encode special characters and prevent XSS attacks.

// Sanitize and escape data before displaying on a webpage
$data = "<script>alert('XSS attack!')</script>";
echo htmlspecialchars($data);