function notify_update() {
  jsonWrapper(URL_NOTIFY_GET_NEW+notify_latest_id+'/', function (data) {
    if (data.success) {
      $('.notification-cnt').html(data.total_count);
      if (data.objects.length> 0) {
        $('.notifications-empty').hide();
      }
      if (data.total_count > 0) {
        $('.notification-cnt').addClass('badge-important');
      } else {
        $('.notification-cnt').removeClass('badge-important');
      }
      for (var i=data.objects.length-1; i >=0 ; i--) {
        n = data.objects[i];
        notify_latest_id = n.pk>notify_latest_id ? n.pk:notify_latest_id;
        notify_oldest_id = (n.pk<notify_oldest_id || notify_oldest_id==0) ? n.pk:notify_oldest_id;
        var element_outer_div = $("<div />");
        var element_a = $("<a />", {href: URL_NOTIFY_GOTO + n.pk + "/"});
        var element_message_div;
        var element_since_div;
        if (n.occurrences > 1) {
          element_message_div = $("<div />", {text: n.message});
          element_since_div = $("<div />", {text: n.occurrences_msg+' - ' + n.since, class: "since"});
        } else {
          element_message_div = $("<div />", {text: n.message});
          element_since_div = $("<div />", {text: n.since, class: "since"});
        }
        element_a.append(element_message_div).append(element_since_div);
        element = element_outer_div.append(element_a);
        element.addClass('dropdown-item notification-item');
        element.insertAfter('.notification-before-list');
      }
    }
  });
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.