Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        $panel_body .= '<br>' . icon('person')
            . '<span class="text-' . $shift['style'] . '">'
            . $needed_angels['need'] . ' &times; ' . $needed_angels['angeltype_name']
            . '</span>';
    }

    $type = 'bg-dark';
    if (theme_type() == 'light') {
        $type = 'bg-light';
    }

    return div('col-md-3 mb-3', [
        div('dashboard-card card border-' . $shift['style'] . ' ' . $type, [
            div('card-body', [
                '<a class="card-link" href="' . shift_link($shift) . '"></a>',
                $panel_body,
            ]),
        ]),
    ]);
}