Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	private function _gen_esi_md5( $params ) {
		$keys = array(
			self::QS_ACTION,
			'_control',
			self::QS_PARAMS,
		);

		$str = '';
		foreach ( $keys as $v ) {
			if ( isset( $params[ $v ] ) && is_string( $params[ $v ] ) ) {
				$str .= $params[ $v ];
			}
		}
		Debug2::debug2( '[ESI] md5_string=' . $str );

		return md5( $this->conf( Base::HASH ) . $str );
	}