What are the potential security risks of using PHP variables directly in a script without proper validation?

Using PHP variables directly in a script without proper validation can lead to security risks such as SQL injection, cross-site scripting (XSS), and other vulnerabilities. To mitigate these risks, it is essential to sanitize and validate user input before using it in your code.

// Example of sanitizing user input before using it in a SQL query
$userInput = $_POST['user_input'];
$cleanInput = mysqli_real_escape_string($connection, $userInput);

// Example of validating user input to prevent XSS attacks
$userInput = $_POST['user_input'];
$cleanInput = htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');