            $ret[$key] = sprintf(
                $format,
                ++$i,
                $err[0],
                $err[1],
                $err[2],
                $err[3]
            );
        }

        return $ret;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.