function PMA_importAjaxStatus($id)
{
    header('Content-type: application/json');
    echo json_encode(
        $_SESSION[$GLOBALS['SESSION_KEY']]['handler']::getUploadStatus($id)
    );
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.