    var update_tooltip = function() {
        var $this = $(this);
        var tag = all_tags[this.getAttribute("data-id")];
        var parent_id = all_tags[this.getAttribute("data-set")];
        var link_owner = null;
        if ($this.parent().attr("id") === "id_selected_tags") {
            link_owner = this.getAttribute("data-linkownername");
            if (link_owner && $this.hasClass('owner-tagged')) {
                link_owner = 'you and ' + link_owner;
            }
        }
        var title = create_tag_title(tag.d, owners[tag.o],
            parent_id ? parent_id.t : null, link_owner);
        $this.tooltip({
            track: false,
            show: false,
            hide: false,
            items: '[data-id]',  // Just needs an attribute that exists
            content: title
        });
    };
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.