What are the potential security implications of using $_POST directly in the value attribute of form inputs in PHP?

Using $_POST directly in the value attribute of form inputs in PHP can pose a security risk known as Cross-Site Scripting (XSS). This is because any user input from the $_POST variable is not sanitized and could contain malicious scripts that can be executed by the browser. To mitigate this risk, it is important to sanitize the user input before displaying it in the form input.

<input type="text" name="username" value="<?php echo htmlspecialchars($_POST['username'] ?? '', ENT_QUOTES); ?>">