    protected function renderText ($field, $makeLinks, $textOnly, $encode) {
        $fieldName = $field->fieldName;
        $value = preg_replace("/(\<br ?\/?\>)|\n/"," ",$this->owner->$fieldName);
        return Yii::app()->controller->convertUrls($this->render ($value, $encode));
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.