What are the potential security risks of not using mysql_escape_string in PHP?

When not using mysql_escape_string in PHP, the code is vulnerable to SQL injection attacks. This means that malicious users can manipulate SQL queries by injecting malicious code into input fields. To prevent this, it is important to sanitize user input before using it in SQL queries by using functions like mysql_escape_string.

// Sanitize user input before using it in SQL queries
$user_input = mysql_escape_string($_POST['user_input']);
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysql_query($query);