Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function angeltype_delete_controller()
{
    if (!auth()->can('admin_angel_types')) {
        throw_redirect(page_link_to('angeltypes'));
    }

    $angeltype = AngelType::findOrFail(request()->input('angeltype_id'));

    if (request()->hasPostData('delete')) {
        $angeltype->delete();
        engelsystem_log('Deleted angeltype: ' . AngelType_name_render($angeltype, true));
        success(sprintf(__('Angeltype %s deleted.'), $angeltype->name));
        throw_redirect(page_link_to('angeltypes'));
    }

    return [
        sprintf(__('Delete angeltype %s'), $angeltype->name),
        AngelType_delete_view($angeltype),
    ];
}