Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function html_select_key($dom_id, $name, $rows, $selected, $selectText = '')
{
    $html = '<select class="form-control" id="' . $dom_id . '" name="' . $name . '">';
    if (!empty($selectText)) {
        $html .= '<option value="">' . $selectText . '</option>';
    }
    foreach ($rows as $key => $row) {
        if (($key == $selected) || ($row === $selected)) {
            $html .= '<option value="' . $key . '" selected="selected">' . $row . '</option>';
        } else {
            $html .= '<option value="' . $key . '">' . $row . '</option>';
        }
    }
    $html .= '</select>';
    return $html;
}