What potential security risks are associated with allowing HTML input in PHP forms and how can they be mitigated?

Allowing HTML input in PHP forms can lead to security risks such as cross-site scripting (XSS) attacks where malicious scripts are injected into the webpage. To mitigate this risk, it is important to sanitize and validate the HTML input before processing it. One way to do this is by using PHP's htmlspecialchars() function to convert special characters into HTML entities.

// Sanitize HTML input using htmlspecialchars()
$html_input = htmlspecialchars($_POST['html_input']);