What is the potential issue with outputting data from a database that includes HTML code, such as image tags?

When outputting data from a database that includes HTML code, such as image tags, there is a risk of Cross-Site Scripting (XSS) attacks if the data is not properly sanitized. To prevent this issue, it is important to escape the HTML characters in the data before outputting it to the browser. This can be done using PHP's htmlspecialchars() function, which converts special characters to HTML entities.

// Retrieve data from the database
$data = "<img src='malicious_script.js'>";

// Sanitize the data before outputting
echo htmlspecialchars($data);