	public function specialLogin( $error = null ) {
		$request = $this->getRequest();
		$out = $this->getOutput();
		$out->setPageTitle( wfMessage('soa2-login-title')->escaped() );
		if ($error) {
			$this->error($error);
		} else if (
			$request->wasPosted() && $request->getCheck( 'username' )
		) {
			$username = $request->getVal( 'username', '', );
			if (!preg_match(SOA2_USERNAME_REGEX, $username)) {
				$this->specialLogin(
					wfMessage('soa2-invalid-username', $username)->plain()
				);
				return;
			}
			if ($request->getCheck( 'token' )) {
				$this->doLogin( $request );
				return;
			}
			$this->loginForm( $request );
			return;
		}
		// Step 11
		$out->addHTML(Html::openElement('form', [ 'method' => 'POST' ]));
		$out->addHTML(Html::rawElement('p', [], Html::label(
			wfMessage('soa2-scratch-username')->escaped(),
			'soa2-username-input',
		)));
		// Step 12
		$out->addHTML(Html::rawElement('p', [], Html::input(
			'username',
			$request->getVal('username', ''),
			'text',
			[ 'id' => 'soa2-username-input' ]
		)));
		$out->addHTML(Html::rawElement('p', [], Html::submitButton(
			wfMessage('soa2-next')->escaped(), []
		)));
		$out->addHTML(Html::closeElement('form'));
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.