    public function action()
    {
        // Do not proceed if the config file cannot be changed
        if (General::checkFile(CONFIG) === false) {
            redirect(SYMPHONY_URL . '/system/preferences/');
        }

        /**
         * Extensions can listen for any custom actions that were added
         * through `AddCustomPreferenceFieldsets` or `AddCustomActions`
         * delegates.
         *
         * @delegate CustomActions
         * @param string $context
         * '/system/preferences/'
         */
        Symphony::ExtensionManager()->notifyMembers('CustomActions', '/system/preferences/');

        if (isset($_POST['action']['save'])) {
            $settings = filter_var_array($_POST['settings'], FILTER_SANITIZE_STRING);

            /**
             * Just prior to saving the preferences and writing them to the `CONFIG`
             * Allows extensions to preform custom validation logic on the settings.
             *
             * @delegate Save
             * @param string $context
             * '/system/preferences/'
             * @param array $settings
             *  An array of the preferences to be saved, passed by reference
             * @param array $errors
             *  An array of errors passed by reference
             */
            Symphony::ExtensionManager()->notifyMembers('Save', '/system/preferences/', array(
                'settings' => &$settings,
                'errors' => &$this->_errors
            ));

            if (!is_array($this->_errors) || empty($this->_errors)) {
                if (is_array($settings) && !empty($settings)) {
                    Symphony::Configuration()->setArray($settings, false);
                }

                if (Symphony::Configuration()->write()) {
                    if (function_exists('opcache_invalidate')) {
                        opcache_invalidate(CONFIG, true);
                    }

                    redirect(SYMPHONY_URL . '/system/preferences/success/');
                }
            }
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.