What best practices should be followed when incorporating user-defined fields, such as "Personalnummer," into PHP code for dynamic content generation?

When incorporating user-defined fields like "Personalnummer" into PHP code for dynamic content generation, it is crucial to sanitize and validate the input to prevent security vulnerabilities such as SQL injection or cross-site scripting attacks. Use PHP functions like htmlspecialchars() and mysqli_real_escape_string() to sanitize the input before using it in database queries or displaying it on the webpage.

// Sanitize and validate user-defined field "Personalnummer"
$personalnummer = isset($_POST['personalnummer']) ? htmlspecialchars(mysqli_real_escape_string($connection, $_POST['personalnummer'])) : '';

// Use the sanitized input in database queries or display it on the webpage
$query = "SELECT * FROM employees WHERE personalnummer = '$personalnummer'";
$result = mysqli_query($connection, $query);

// Display the user-defined field on the webpage
echo "Personalnummer: " . $personalnummer;