Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function user_edit_vouchers_controller()
{
    $user = auth()->user();
    $request = request();

    if ($request->has('user_id')) {
        $user_source = User::find($request->input('user_id'));
    } else {
        $user_source = $user;
    }

    if (
        (!auth()->can('admin_user') && !auth()->can('voucher.edit'))
        || !config('enable_voucher')
    ) {
        throw_redirect(page_link_to());
    }

    if ($request->hasPostData('submit')) {
        $valid = true;

        $vouchers = '';
        if (
            $request->has('vouchers')
            && test_request_int('vouchers')
            && trim($request->input('vouchers')) >= 0
        ) {
            $vouchers = trim($request->input('vouchers'));
        } else {
            $valid = false;
            error(__('Please enter a valid number of vouchers.'));
        }

        if ($valid) {
            $user_source->state->got_voucher = $vouchers;
            $user_source->state->save();

            success(__('Saved the number of vouchers.'));
            engelsystem_log(User_Nick_render($user_source, true) . ': ' . sprintf(
                'Got %s vouchers',
                $user_source->state->got_voucher
            ));

            throw_redirect(user_link($user_source->id));
        }
    }

    return [
        sprintf(__('%s\'s vouchers'), $user_source->displayName),
        User_edit_vouchers_view($user_source),
    ];
}