Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function ShiftEntry_create_view_user(Shift $shift, Room $room, AngelType $angeltype, $comment)
{
    $start = $shift->start->format(__('Y-m-d H:i'));
    return page_with_title(
        ShiftEntry_create_title() . ': ' . $shift->shiftType->name
        . ' <small title="' . $start . '" data-countdown-ts="' . $shift->start->timestamp . '">%c</small>',
        [
            Shift_view_header($shift, $room),
            info(sprintf(__('Do you want to sign up for this shift as %s?'), $angeltype->name), true),
            form([
                form_textarea('comment', __('Comment (for your eyes only):'), $comment),
                form_submit('submit', icon('check-lg') . __('Save')),
            ]),
        ]
    );
}