	public function escape($input)
	{
		// Ensure we have valid correctly encoded string..
		// http://stackoverflow.com/questions/1412239/why-call-mb-convert-encoding-to-sanitize-text
		$input = mb_convert_encoding($input, "UTF-8", "UTF-8");
		// why are we using html entities? this -> http://stackoverflow.com/a/110576/992171
		return htmlentities($input, ENT_QUOTES, 'UTF-8');
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.