What are the potential security risks associated with allowing user-generated comments in a PHP application?

Potential security risks associated with allowing user-generated comments in a PHP application include SQL injection attacks, cross-site scripting (XSS) attacks, and spam. To mitigate these risks, it is important to sanitize user input before storing it in the database and to escape output when displaying it to prevent XSS attacks.

// Sanitize user input before storing it in the database
$comment = filter_var($_POST['comment'], FILTER_SANITIZE_STRING);

// Escape output when displaying comments
echo htmlentities($comment);