What potential security risks are associated with not using htmlspecialchars() in PHP code?

Not using htmlspecialchars() in PHP code can leave your application vulnerable to cross-site scripting (XSS) attacks, where malicious scripts are injected into your web pages. This can lead to unauthorized access to sensitive information or manipulation of your website's content. To prevent this, always use htmlspecialchars() to encode special characters in user input before displaying it on your web pages.

// Using htmlspecialchars() to encode special characters in user input
$user_input = "<script>alert('XSS attack!');</script>";
echo htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8');