Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
function to_money(
    number, 
    decimalPlaces = null,
    decimalSeparator = "",
	thousandSeparator = "",
	currencySymbol = "",
	currencySymbolPosition = ""
    ) {

        var currencySymbol = empty(currencySymbol) ? get_options("currencySymbol") : currencySymbol;
        var currencySymbolPosition = empty(currencySymbolPosition) ? get_options("currencySymbolPosition") : currencySymbolPosition;

        var formatedNumber = format_number(number, decimalPlaces = decimalPlaces, decimalSeparator = decimalSeparator, thousandSeparator = thousandSeparator);

        if( !empty(currencySymbolPosition) && currencySymbolPosition.toLowerCase === "right" ) {
            formatedNumber = formatedNumber + " " +  currencySymbol;
        } else {
            formatedNumber = currencySymbol + " " + formatedNumber;
        }

        return formatedNumber;
}