    public function validateEmail ($option, $optRule) {
        if (isset ($option['value'])) {
            try {
                EmailDeliveryBehavior::addressHeaderToArray ($option['value']);
            } catch (CException $e) {
                return array (false, $e->getMessage ());
            }
        }
        return array (true, '');
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.