Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function shifttype_delete_controller()
{
    $request = request();
    if (!$request->has('shifttype_id')) {
        throw_redirect(page_link_to('shifttypes'));
    }

    $shifttype = ShiftType::findOrFail($request->input('shifttype_id'));
    if ($request->hasPostData('delete')) {
        engelsystem_log('Deleted shifttype ' . $shifttype->name);
        success(sprintf(__('Shifttype %s deleted.'), $shifttype->name));

        $shifttype->delete();
        throw_redirect(page_link_to('shifttypes'));
    }

    return [
        sprintf(__('Delete shifttype %s'), $shifttype->name),
        ShiftType_delete_view($shifttype),
    ];
}