    protected function listify($array, $polite = false) {
        if (empty($array)) return 'None';
        $ret = '';
        $i = count($array);
        foreach ($array as $value) {
            $i--;
            $ret .= $value;
            if ($i > 0 && !($polite && $i == 1)) $ret .= ', ';
            if ($polite && $i == 1) $ret .= 'and ';
        }
        return $ret;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.