function shibboleth_login_form() {
	$login_url = add_query_arg('action', 'shibboleth');
	$login_url = remove_query_arg('reauth', $login_url);
	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.