Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function ShiftEntry_create_view_supporter(Shift $shift, Room $room, AngelType $angeltype, $signup_user, $users_select)
{
    $start = $shift->start->format(__('Y-m-d H:i'));
    return page_with_title(
        ShiftEntry_create_title() . ': ' . $shift->shiftType->name
        . ' <small title="' . $start . '" data-countdown-ts="' . $shift->start->timestamp . '">%c</small>',
        [
            Shift_view_header($shift, $room),
            info(sprintf(
                __('Do you want to sign up the following user for this shift as %s?'),
                $angeltype->name
            ), true),
            form([
                form_select('user_id', __('User'), $users_select, $signup_user->id),
                form_submit('submit', icon('check-lg') . __('Save')),
            ]),
        ]
    );
}