Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function validate() {
	if (!ctype_alnum($_POST ['fpuser']))
		$err [] = "{$_POST['fpuser']} is not a valid username. 
		Username must be alphanumeric and should not contain spaces.";

	if (strlen(trim(($_POST ['fppwd']))) < 6)
		$err [] = "Password must contain at least 6 non-space characters";

	if (($_POST ['fppwd']) != ($_POST ['fppwd2']))
		$err [] = "Passwords did not match";

	if (!(preg_match('!@.*@|\.\.|\,|\;!', $_POST ['email']) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $_POST ['email'])))
		$err [] = "{$_POST['email']} is not a valid email address";

	$www = $_POST ['www'];
	if (!(preg_match('!^http(s)?://[\w-]+\.[\w-]+(\S+)?$!i', $www) || preg_match('!^http(s)?://localhost!', $www)))
		$err [] = "$www is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/')
		$www .= '/';

	global $fp_config;

	$fp_config ['general'] ['author'] = $user ['userid'] = $_POST ['fpuser'];
	$user ['password'] = $_POST ['fppwd'];

	$fp_config ['general'] ['www'] = $user ['www'] = $www;
	$fp_config ['general'] ['email'] = $user ['email'] = $_POST ['email'];

	if (isset($err)) {
		$GLOBALS ['err'] = $err;
		return false;
	}

	$fp_config ['general'] ['blogid'] = system_generate_id(BLOG_ROOT . $user ['www'] . $user ['email'] . $user ['userid']);

	config_save();

	system_hashsalt_save();

	user_add($user);

	return true;
}