Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function calculateProductHavingQuantity(int $productId) {
    global $table_prefeix;

    return easySelect(
        "products",
        "product_id, ( IF(purchase_item_quantity IS NULL, 0, SUM(purchase_item_quantity) + if(returns_products_quantity is null, 0, returns_products_quantity) ) - IF(sale_item_quantity IS NULL, 0, SUM(sale_item_quantity))) AS having_item_quantity",
        array (
            "left join (select purchase_item_product_id, sum(purchase_item_quantity) as purchase_item_quantity from {$table_prefeix}product_purchase_items where is_trash = 0 group by purchase_item_product_id) as {$table_prefeix}product_purchase_items on purchase_item_product_id = product_id",
            "left join (select sale_item_product_id, sum(sale_item_quantity) as sale_item_quantity from {$table_prefeix}sale_items where is_trash = 0 group by sale_item_product_id) as {$table_prefeix}sale_items on sale_item_product_id = product_id",
            "left join (select product_return_items_product_id, sum(product_return_items_products_quantity) as returns_products_quantity from {$table_prefeix}product_return_items where is_trash = 0 group by product_return_items_product_id) as returns_product on product_id = product_return_items_product_id"
        ),
        array (
            "product_id " =>  $productId
        )
    )['data'][0]["having_item_quantity"];
}