Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function ShiftEntry_create_view_admin(
    Shift $shift,
    Room $room,
    AngelType $angeltype,
    $angeltypes_select,
    $signup_user,
    $users_select
) {
    $start = $shift->start->format(__('Y-m-d H:i'));
    return page_with_title(
        ShiftEntry_create_title() . ': ' . $shift->shiftType->name
        . ' <small title="' . $start . '" data-countdown-ts="' . $shift->start->timestamp . '">%c</small>',
        [
            Shift_view_header($shift, $room),
            info(__('Do you want to sign up the following user for this shift?'), true),
            form([
                form_select('angeltype_id', __('Angeltype'), $angeltypes_select, $angeltype->id),
                form_select('user_id', __('User'), $users_select, $signup_user->id),
                form_submit('submit', icon('check-lg') . __('Save')),
            ]),
        ]
    );
}