What potential pitfalls should be considered when attempting to create a guestbook with PHP that includes clickable email links?

When creating a guestbook with PHP that includes clickable email links, one potential pitfall to consider is the risk of email injection attacks. This can occur when users input malicious code into the form fields, which can then be executed when the email link is clicked. To prevent this, it is important to sanitize user input and properly encode email addresses before displaying them as clickable links.

// Sanitize user input and encode email addresses before displaying as clickable links
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$email = htmlspecialchars($email);

echo '<a href="mailto:' . $email . '">' . $email . '</a>';