Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function shifttype_controller()
{
    $request = request();
    if (!$request->has('shifttype_id')) {
        throw_redirect(page_link_to('shifttypes'));
    }
    $shifttype = ShiftType::findOrFail($request->input('shifttype_id'));

    return [
        $shifttype->name,
        ShiftType_view($shifttype),
    ];
}