What potential pitfalls should be considered when using the nl2br function in PHP?

When using the nl2br function in PHP to convert newline characters to HTML line breaks, one potential pitfall to consider is that it can lead to a vulnerability known as Cross-Site Scripting (XSS) if user input is not properly sanitized. To mitigate this risk, it is important to always sanitize user input before passing it to the nl2br function.

// Sanitize user input before using nl2br function
$user_input = htmlspecialchars($_POST['user_input']);
echo nl2br($user_input);