What potential security risks are associated with using user input directly in email headers in PHP?

When using user input directly in email headers in PHP, there is a risk of header injection attacks where malicious users can inject additional headers or manipulate existing ones. To mitigate this risk, it is important to sanitize and validate user input before using it in email headers. One way to do this is by using the `filter_var()` function with the `FILTER_SANITIZE_STRING` filter to remove any potentially harmful characters.

// Sanitize user input for email headers
$subject = filter_var($_POST['subject'], FILTER_SANITIZE_STRING);
$to = filter_var($_POST['to'], FILTER_SANITIZE_EMAIL);

// Send email with sanitized headers
$headers = "From: sender@example.com\r\n";
$headers .= "Reply-To: sender@example.com\r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";

mail($to, $subject, $message, $headers);