Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private static function _build_inline( $url, $inline_param ) {
		if ( ! $url || empty( $inline_param[ 'val' ] ) || empty( $inline_param[ 'control' ] ) || empty( $inline_param[ 'tag' ] ) ) {
			return '';
		}

		return "<esi:inline name='$url' cache-control='" . $inline_param[ 'control' ] . "' cache-tag='" . $inline_param[ 'tag' ] . "'>" . $inline_param[ 'val' ] . "</esi:inline>";
	}