What potential security risks are associated with using the exec() function in PHP to execute commands on a server?

Using the exec() function in PHP to execute commands on a server can pose potential security risks, such as allowing for arbitrary code execution and exposing sensitive information. To mitigate these risks, it is important to sanitize user input and validate the commands being executed to prevent malicious code injection.

$command = escapeshellcmd($user_input);
exec($command, $output);