Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	function onsave() {
		global $fp_config;
		$l = explode(',', $_POST ['lang']);
		$fp_config ['general'] = array(
			// 'BLOG_ROOT' => $_POST['blog_root'],
			'www' => $_POST ['www'],
			'title' => wp_specialchars(stripslashes($_POST ['title'])),
			'subtitle' => wp_specialchars(stripslashes($_POST ['subtitle'])),
			'footer' => wp_specialchars(stripslashes($_POST ['blogfooter'])),
			'author' => $_POST ['author'],
			'email' => $_POST ['email'],
			'startpage' => ($_POST ['startpage'] == ':NULL:') ? null : $_POST ['startpage'],
			'maxentries' => $_POST ['maxentries'],
			// 'voting' => $_POST['voting'],
			'notify' => isset($_POST ['notify']),
				/* preserve the following */
				'theme' => $fp_config ['general'] ['theme'],
			'style' => @$fp_config ['general'] ['style'],
			'blogid' => $fp_config ['general'] ['blogid'],
			'charset' => 'utf-8'
		);

		$fp_config ['locale'] = array(
			'timeoffset' => $_POST ['timeoffset'],
			'timeformat' => $_POST ['timeformat'],
			'dateformat' => $_POST ['dateformat'],
			'dateformatshort' => $_POST ['dateformatshort'],
			'charset' => $_POST ['charset'],
			'lang' => $_POST ['lang']
		);

		// 'LANG' => $l[0],
		// 'CHARSET'=> $l[1],

		$success = config_save() ? 1 : -1;

		$this->smarty->assign('success', $success);

		return 1;
	}