Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    private function renderShiftHead(Shift $shift, $class, $needed_angeltypes_count)
    {
        $header_buttons = '';
        if (auth()->can('admin_shifts')) {
            $header_buttons = '<div class="ms-auto d-print-none">' . table_buttons([
                    button(
                        page_link_to('user_shifts', ['edit_shift' => $shift->id]),
                        icon('pencil'),
                        'btn-' . $class . ' btn-sm border-light text-white'
                    ),
                    button(
                        page_link_to('user_shifts', ['delete_shift' => $shift->id]),
                        icon('trash'),
                        'btn-' . $class . ' btn-sm border-light text-white'
                    ),
                ]) . '</div>';
        }
        $shift_heading = $shift->start->format('H:i') . ' &dash; '
            . $shift->end->format('H:i') . ' &mdash; '
            . $shift->shiftType->name;

        if ($needed_angeltypes_count > 0) {
            $shift_heading = '<span class="badge bg-light text-danger me-1">' . $needed_angeltypes_count . '</span> ' . $shift_heading;
        }

        return div('card-header d-flex align-items-center', [
            '<a class="d-flex align-items-center text-white" href="' . shift_link($shift) . '">' . $shift_heading . '</a>',
            $header_buttons,
        ]);
    }