What potential pitfalls should be considered when allowing users to upload and display text on a website using PHP?

One potential pitfall when allowing users to upload and display text on a website using PHP is the risk of cross-site scripting (XSS) attacks. To prevent this, it is important to properly sanitize and validate user input before displaying it on the website. This can be done by using functions like htmlspecialchars() to escape special characters and prevent malicious scripts from being executed.

// Sanitize user input before displaying on the website
$user_input = "<script>alert('XSS attack!');</script>";
$sanitized_input = htmlspecialchars($user_input);

echo $sanitized_input;