What is the potential issue with using nl2br before executing a database query in PHP?

Using nl2br before executing a database query in PHP can potentially lead to SQL injection vulnerabilities. It is important to sanitize user input before inserting it into a database query to prevent malicious code execution. To solve this issue, you should first sanitize the input using functions like mysqli_real_escape_string or prepared statements, and then apply nl2br to format the output for display.

// Sanitize user input using mysqli_real_escape_string
$input = mysqli_real_escape_string($connection, $_POST['input']);

// Execute the sanitized query
$query = "INSERT INTO table_name (column_name) VALUES ('$input')";
mysqli_query($connection, $query);

// Format the output for display
$output = nl2br($input);

// Display the output
echo $output;