						$rqv = strip_tags($rqv);
					}
					$v = implode(',', $_REQUEST[$var]);
				}
				else
				{
					// TODO add more validation handling checks... then again, PTS client has its own validation of the env vars
					$v = strip_tags($_REQUEST[$var]);
				}
				if(!empty($v) && $v !== 0)
				{
					$posted[$var] = $v;
				}
			}
		}
		return $posted;
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.