	public function set_controller($controller, $action)
	{
		include CLASS_DIR . 'module.php';

		$module = new Module($controller);

		define ('MODULE_NAME', $module->get_name());

		$class_file = APP_DIR . 'controller/' . MODULE_NAME . '.php';
		$class_name = ucfirst(MODULE_NAME) . '_Controller';
		$class_method = ucfirst($action) . '_Action';

		// tworzy obiekt kontrolera:

		if (file_exists($class_file))
		{
			include $class_file;

			if (class_exists($class_name))
			{
				$this->controller_object = new $class_name($this);

				$this->set_acl($this);
			}
			else
			{
				die ('Class: <h3>'.$class_name.'</h3> not found.');
			}
		}
		else
		{
			die ('File: <h3>'.$class_file.'</h3> not found.');
		}

		// tworzy obiekt modelu:

		$this->set_model_object(MODULE_NAME);

		// tworzy obiekt widoku:

		$this->set_view_object(MODULE_NAME);

		// wywołuje akcję (metodę) kontrolera:

		if (method_exists($class_name, $class_method))
		{
			$this->controller_object->{$class_method}();
		}
		else
		{
			die ('Method: <h3>'.$class_method.'</h3> in class: <h3>'.$class_name.'</h3> not found.');
		}
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.