Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
		function onsave() {
		
			global $fp_config;
			$l = explode(',',$_POST['lang']);
			$fp_config['general'] = array(
			//'BLOG_ROOT'	=> $_POST['blog_root'],
				'www'	=> $_POST['www'],
				'title' => html_entity_decode(stripslashes($_POST['title'])),
				'subtitle' => html_entity_decode(stripslashes($_POST['subtitle'])),
				'footer' => html_entity_decode(stripslashes($_POST['blogfooter'])),
				'author' => $_POST['author'],
				'email' => $_POST['email'],
				'startpage' => ($_POST['startpage'] == ':NULL:')? null : $_POST['startpage'],
				'maxentries' => $_POST['maxentries'],
				// 'voting' => $_POST['voting'],
				'notify' => isset($_POST['notify']),
				/* preserve the following */
				'theme'	=> $fp_config['general']['theme'],
				'style'	=> @$fp_config['general']['style'],
				'blogid' => $fp_config['general']['blogid'],
				'charset'=> 'utf-8',
	
			);
			
			$fp_config['locale'] = array(
				'timeoffset' => $_POST['timeoffset'],
				'timeformat' => $_POST['timeformat'],
				'dateformat' => $_POST['dateformat'],
				'dateformatshort' => $_POST['dateformatshort'],
				'charset'	 => $_POST['charset'],
				'lang'		 => $_POST['lang']
			);
			

			// 'LANG'	=> $l[0],
			// 'CHARSET'=> $l[1],
	
			
				

			
			$success = config_save()? 1: -1;
			
			$this->smarty->assign('success', $success);
			
			return 1;
			
		}