Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function ShiftEntry_delete_view_admin(Shift $shift, AngelType $angeltype, User $signoff_user)
{
    return page_with_title(ShiftEntry_delete_title(), [
        info(sprintf(
            __('Do you want to sign off %s from shift %s from %s to %s as %s?'),
            User_Nick_render($signoff_user),
            $shift->shiftType->name,
            $shift->start->format(__('Y-m-d H:i')),
            $shift->end->format(__('Y-m-d H:i')),
            $angeltype->name
        ), true),
        form([
            buttons([
                button(user_link($signoff_user->id), icon('x-lg') . __('cancel')),
                form_submit('delete', icon('trash') . __('sign off'), 'btn-danger', false),
            ]),
        ]),
    ]);
}