Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
        foreach ($categories as $category) {
            $decks .= '<div class="card mb-4"><a href="' . $category['url'] . '">';
            if ('' !== $category['image']) {
                $decks .= '<img class="card-img-top embed-responsive-item" width="200" alt="' .
                $category['name'] . '" src="' . $category['image'] . '" />';
            }
            $decks .= '</a>' .
                '<div class="card-body">' .
                '<h4 class="card-title text-center">' .
                '<a href="' . Strings::htmlentities($category['url']) . '">' .
                Strings::htmlentities($category['name']) . '</a>' .
                '</h4>' .
                '<p class="card-text">' . $category['description'] . '</p>' .
                '</div>' .
                '</div>';
            if ($key % 2 === 0) {
                $decks .= '<div class="w-100 d-none d-sm-block d-md-none"></div>';
            }
            if ($key % 3 === 0) {
                $decks .= '<div class="w-100 d-none d-md-block d-lg-none"></div>';
            }
            if ($key % 4 === 0) {
                $decks .= '<div class="w-100 d-none d-lg-block d-xl-block"></div>';
            }
            $key++;
        }