  def test_strip_tags_with_quote
    sanitizer = HTML::FullSanitizer.new
    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'

    assert_equal ' hi', sanitizer.sanitize(string)
  end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.