Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	public function contain_preserve_esi( $content ) {
		$hit_list = array();
		foreach ( $this->_esi_preserve_list as $k => $v ) {
			if ( strpos( $content, '"' . $k . '"' ) !== false ) {
				$hit_list[] = '"' . $k . '"';
			}
			if ( strpos( $content, "'" . $k . "'" ) !== false ) {
				$hit_list[] = "'" . $k . "'";
			}
		}
		return $hit_list;
	}