            $text = preg_replace($exp, '', $text);
        }

        // Primary expression to filter out tags
        $exp = '/(?:^|\s|\.)(#\w+[-\w]+\w+|#\w+)(?:$|[^\'"])/u';

        $matches = array();
        preg_match_all($exp, $text, $matches);

        return $matches;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.