Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function save_deleted_date($table, $data) {
    global $table_prefeix;	// table prefix;
    global $conn;			// MySQL connection variable.
    
    // Serialize the data
    $data = serialize($data);

    // Insert deleted data
    $conn->query("INSERT INTO {$table_prefeix}deleted_data (deleted_from, deleted_data, deleted_by) VALUES ('{$table}', '{$data}', '{$_SESSION['uid']}')");

}