Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function near_unit_qty($product_id, $qty, $unit) {

    global $table_prefeix;

    $getData = easySelectA(array(
        "table"     => "products as whereProduct",
        "fields"    => "joinProduct.product_unit as product_unit, equal_unit_qnt, base_qnt",
        "join"      => array(
            "left join {$table_prefeix}products as joinProduct on joinProduct.product_name = whereProduct.product_name",
            "left join {$table_prefeix}product_units on unit_name = joinProduct.product_unit"
        ),
        "where"     => array(
            "joinProduct.is_trash = 0 and joinProduct.product_unit is not null and whereProduct.product_id" => $product_id
        ),
        "orderby"   => array(
            "base_qnt"  => "DESC"
        )
    ));
    

    if($getData !== false) {

        $totalBaseQty = $qty;
        $remainQty = 0;
        $finalUnitName = "";
        $finalQtyBasedOnUnit = 0;
        
        // Generate the base qty based on unit
        foreach($getData["data"] as $pKey => $pVal ) {
        
            if( $pVal["product_unit"] === $unit) {
        
                $totalBaseQty *= $pVal["base_qnt"];
                break;
        
            }
        
        }
        
        // Now get the unit which base_qnt is grater then or equal to unitDevider
        foreach($getData["data"] as $pKey => $pVal ) {
        
            if( $pVal["base_qnt"] <= $totalBaseQty) {
        
                $finalUnitName = $pVal["product_unit"];
                $remainQty = ($totalBaseQty % $pVal["base_qnt"]);
                $finalQtyBasedOnUnit = ($totalBaseQty - $remainQty) / $pVal["base_qnt"];
                break;
        
            }
        
        }


        return $finalQtyBasedOnUnit . " " . $finalUnitName . ( $remainQty > 0 ? ", " . near_unit_qty($product_id, $remainQty, $unit) : "");

    } else {