Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function smarty_function_sugarvar($params, &$smarty)
{
	if(empty($params['key']))  {
	    $smarty->trigger_error("sugarvar: missing 'key' parameter");
	    return;
	}

	$object = (empty($params['objectName']))?$smarty->get_template_vars('parentFieldArray'): $params['objectName'];
	$displayParams = $smarty->get_template_vars('displayParams');


	if(empty($params['memberName'])){
		$member = $smarty->get_template_vars('vardef');
		$member = $member['name'];
	}else{
		$members = explode('.', $params['memberName']);
		$member =  $smarty->get_template_vars($members[0]);
		for($i = 1; $i < count($members); $i++){
			$member = $member[$members[$i]];
		}
	}

    $_contents =  '$'. $object . '.' . $member . '.' . $params['key'];
	if(empty($params['stringFormat']) && empty($params['string'])) {
		$_contents = '{' . $_contents;
		if(!empty($displayParams['htmlescape'])){
			$_contents .= '|escape:\'html\'';
		}
		if(!empty($params['htmlentitydecode'])){
			$_contents .= '|escape:\'html_entity_decode\'';
		}
		if(!empty($displayParams['strip_tags'])){
			$_contents .= '|strip_tags';
		}
		if(!empty($displayParams['url2html'])){
			$_contents .= '|url2html';
		}
		if(!empty($displayParams['nl2br'])){
			$_contents .= '|nl2br';
		}

		$_contents .= '}';
    }
    return $_contents;
}