Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
  function render(&$table, $value, $row, $column, $selected = false) {
    global $user;
    $showNotes = $user->isOptionEnabled('week_notes');

    $field_name = $table->getValueAt($row,$column)['control_id']; // Our text field names (and ids) are like x_y (row_column).
    $field = new TextField($field_name);
    // Disable control if the date is locked.
    global $lockedDays;
    if ($lockedDays[$column])
      $field->setEnabled(false);
    $field->setFormName($table->getFormName());
    $field->setStyle('width: 60px;'); // TODO: need to style everything properly, eventually.
    // Provide visual separation for new entry row.
    $rowToSeparate = $showNotes ? 1 : 0;
    if ($rowToSeparate == $row) {
      $field->setStyle('width: 60px; margin-bottom: 40px');
    }
    if ($showNotes) {
      if (0 == $row % 2) {
        $field->setValue($table->getValueAt($row,$column)['duration']); // Duration for even rows.
      } else {
        $field->setValue($table->getValueAt($row,$column)['note']);     // Comment for odd rows.
        $field->setTitle($table->getValueAt($row,$column)['note']);     // Tooltip to help view the entire comment.
      }
    } else {
      $field->setValue($table->getValueAt($row,$column)['duration']);
      // $field->setTitle($table->getValueAt($row,$column)['note']); // Tooltip to see comment. TODO - value not available.
    }
    // Disable control when time entry mode is TYPE_START_FINISH and there is no value in control
    // because we can't supply start and finish times in week view - there are no fields for them.
    if (!$field->getValue() && TYPE_START_FINISH == $user->getRecordType()) {
        $field->setEnabled(false);
    }
    $this->setValue($field->getHtml());
    return $this->toString();
  }