            $retVal = preg_replace ($pattern, $replacement, $subject, $limit);
        } else {
            $retVal = preg_replace ($pattern, $replacement, $subject);
        }

        if ($throws && $retVal === null) {
            throw new StringUtilException (
                Yii::t('app', 'preg_replace error: '.
                    StringUtilException::getErrorMessage (preg_last_error ())), 
                StringUtilException::PREG_REPLACE_ERROR);
        }
        return $retVal;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.