What potential security risks are associated with using shell_exec in PHP to execute external commands?

Using shell_exec in PHP to execute external commands can pose security risks such as command injection attacks, where an attacker can manipulate the input to execute arbitrary commands on the server. To mitigate this risk, it is recommended to use escapeshellarg() or escapeshellcmd() to sanitize the input before passing it to shell_exec.

$command = escapeshellarg($user_input);
$output = shell_exec("ls " . $command);