What are the potential risks of using system commands like scandisk in PHP scripts on Windows servers?

Using system commands like scandisk in PHP scripts on Windows servers can pose security risks as it allows for potential command injection attacks if user input is not properly sanitized. To mitigate this risk, it is recommended to use PHP functions or libraries that provide similar functionality instead of relying on system commands.

// Example of using PHP's built-in functions to check disk space instead of using system commands
$disk_space = disk_free_space("C:");
echo "Free disk space on C: drive: " . $disk_space;