Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        $angel_types_spinner .= form_spinner(
            'angeltype_count_' . $angeltype_id,
            $angeltype_name,
            $needed_angel_types[$angeltype_id]
        );
    }

    return page_with_title(
        shifts_title(),
        [
            msg(),
            '<noscript>'
            . info(__('This page is much more comfortable with javascript.'), true)
            . '</noscript>',
            form([
                form_select('shifttype_id', __('Shifttype'), $shifttypes, $shifttype_id),
                form_text('title', __('Title'), $title),
                form_select('rid', __('Room:'), $rooms, $rid),
                form_text('start', __('Start:'), $start->format('Y-m-d H:i')),
                form_text('end', __('End:'), $end->format('Y-m-d H:i')),
                form_textarea('description', __('Additional description'), $description),
                form_info('', __('This description is for single shifts, otherwise please use the description in shift type.')),
                '<h2>' . __('Needed angels') . '</h2>',
                $angel_types_spinner,
                form_submit('submit', __('Save')),
            ]),
        ]
    );
}