Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        $shift->needed_angeltypes = Db::select(
            '
            SELECT DISTINCT `angel_types`.*
            FROM `shift_entries`
            JOIN `angel_types` ON `shift_entries`.`angel_type_id`=`angel_types`.`id`
            WHERE `shift_entries`.`shift_id` = ?
            ORDER BY `angel_types`.`name`
            ',
            [$shift->id]
        );
        $neededAngeltypes = $shift->needed_angeltypes;
        foreach ($neededAngeltypes as &$needed_angeltype) {
            $needed_angeltype['users'] = Db::select(
                '
                    SELECT `shift_entries`.`freeloaded`, `users`.*
                    FROM `shift_entries`
                    JOIN `users` ON `shift_entries`.`user_id`=`users`.`id`
                    WHERE `shift_entries`.`shift_id` = ?
                    AND `shift_entries`.`angel_type_id` = ?
                ',
                [$shift->id, $needed_angeltype['id']]
            );
        }
        $shift->needed_angeltypes = $neededAngeltypes;
    }

    if (empty($user_source->api_key)) {
        User_reset_api_key($user_source, false);
    }

    if ($user_source->state->force_active) {
        $tshirt_score = __('Enough');
    } else {
        $tshirt_score = sprintf('%.2f', User_tshirt_score($user_source->id)) . '&nbsp;h';
    }

    return [
        $user_source->displayName,
        User_view(
            $user_source,
            auth()->can('admin_user'),
            $user_source->isFreeloader(),
            $user_source->userAngelTypes,
            $user_source->groups,
            $shifts,
            $user->id == $user_source->id,
            $tshirt_score,
            auth()->can('admin_active'),
            auth()->can('admin_user_worklog'),
            UserWorkLogsForUser($user_source->id)
        ),
    ];
}