What are the potential security risks of displaying specific error messages, such as "Password is incorrect," in a login script?

Displaying specific error messages like "Password is incorrect" in a login script can potentially expose sensitive information to attackers, making it easier for them to guess valid usernames and passwords. To mitigate this risk, it is recommended to provide a generic error message like "Invalid username or password" to prevent attackers from gaining insight into the validity of their guesses.

// Display a generic error message for invalid login attempts
if ($login_successful) {
    // Proceed with login logic
} else {
    echo "Invalid username or password";
}