What are the potential security risks associated with directly outputting user input in PHP forms without proper validation and sanitization?

Directly outputting user input in PHP forms without proper validation and sanitization can lead to security risks such as cross-site scripting (XSS) attacks. To mitigate this risk, it is important to validate and sanitize user input before displaying it on the webpage. This can be done by using functions like htmlspecialchars() to encode special characters and prevent malicious scripts from being executed.

// Validate and sanitize user input before outputting
$userInput = $_POST['user_input'];
$cleanInput = htmlspecialchars($userInput);

echo $cleanInput;