What is the potential security risk of not escaping user input in PHP scripts, as seen in the provided code snippets?

Not escaping user input in PHP scripts can lead to security vulnerabilities such as SQL injection, cross-site scripting (XSS), and other forms of injection attacks. To mitigate this risk, it is important to properly sanitize and escape user input before using it in SQL queries, HTML output, or other contexts where it could be exploited.

// Original vulnerable code snippet
$user_input = $_POST['input'];
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($conn, $query);

// Fixed code snippet with input escaping
$user_input = mysqli_real_escape_string($conn, $_POST['input']);
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($conn, $query);