Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function ShiftEntry_edit_view(
    $angel,
    $date,
    $location,
    $title,
    $type,
    $comment,
    $freeloaded,
    $freeloaded_comment,
    $user_admin_shifts = false
) {
    $freeload_form = [];
    if ($user_admin_shifts) {
        $freeload_form = [
            form_checkbox('freeloaded', __('Freeloaded'), $freeloaded),
            form_textarea(
                'freeloaded_comment',
                __('Freeload comment (Only for shift coordination):'),
                $freeloaded_comment
            ),
        ];
    }

    if ($angel->id == auth()->user()->id) {
        $comment = form_textarea('comment', __('Comment (for your eyes only):'), $comment);
    } else {
        $comment = '';
    }

    return page_with_title(__('Edit shift entry'), [
        msg(),
        form([
            form_info(__('Angel:'), User_Nick_render($angel)),
            form_info(__('Date, Duration:'), $date),
            form_info(__('Location:'), $location),
            form_info(__('Title:'), $title),
            form_info(__('Type:'), $type),
            $comment,
            join('', $freeload_form),
            form_submit('submit', __('Save')),
        ]),
    ]);
}