        $period_days_append_sql=  substr($period_days_append_sql,0,-4).'))';
    }
   
    $exist_RET=  DBGet(DBQuery("SELECT s.ID FROM schedule s WHERE student_id=".  $student_id." AND s.syear='".UserSyear()."' {$mp_append_sql}{$period_days_append_sql} UNION SELECT s.ID FROM temp_schedule s WHERE student_id=".  $student_id."{$mp_append_sql}{$period_days_append_sql}"));
    if($exist_RET)
        return 'There is a Period Conflict ('.$course_RET[1]['CP_TITLE'].')';
    else
    {
        return true;
    }
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.