    public function testNestingTags()
    {
        $code = '[url=http://jbbcode.com][b]hello [u]world[/u][/b][/url]';
        $html = '<a href="http://jbbcode.com"><strong>hello <u>world</u></strong></a>';
        $this->assertProduces($code, $html);
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.