    protected function backward(&$i, &$current) {
        if ($i === null) $i = $this->inputIndex - 1;
        else $i--;
        if ($i < 0) return false;
        $current = $this->inputTokens[$i];
        return true;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.