    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        try {
            UserFactory.init();
        } catch (Throwable e) {
            throw new ServletException("AddNewUserServlet: Error initialising user factory." + e);
        }
        UserManager userFactory = UserFactory.getInstance();

        String userID = request.getParameter("userID");

        if (userID != null && userID.matches(".*[&<>\"`']+.*")) {
            throw new ServletException("User ID must not contain any HTML markup.");
        }

        String password = request.getParameter("pass1");

        boolean hasUser = false;
        try {
            hasUser = userFactory.hasUser(userID);
        } catch (Throwable e) {
            throw new ServletException("can't determine if user " + userID + " already exists in users.xml.", e);
        }

        if (hasUser) {
            RequestDispatcher dispatcher = this.getServletContext().getRequestDispatcher("/admin/userGroupView/users/newUser.jsp?action=redo");
            dispatcher.forward(request, response);
        } else {
            final Password pass = new Password();
            pass.setEncryptedPassword(UserFactory.getInstance().encryptedPassword(password, true));
            pass.setSalt(true);

            final User newUser = new User();
            newUser.setUserId(userID);
            newUser.setPassword(pass);

            final HttpSession userSession = request.getSession(false);
            userSession.setAttribute("user.modifyUser.jsp", newUser);

            // forward the request for proper display
            RequestDispatcher dispatcher = this.getServletContext().getRequestDispatcher("/admin/userGroupView/users/modifyUser.jsp");
            dispatcher.forward(request, response);
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.