    public function renameUser($new_name)
    {
        // Rename only if a new name is really new
        if ($this->userName != $new_name) {
            // Save old name
            $old_name = $this->userName;
            // Rename user
            $this->userName = $new_name;
            $this->save();

            // Send message about renaming
            $message = getlocal(
                "The visitor changed their name <strong>{0}</strong> to <strong>{1}</strong>",
                array($old_name, $new_name),
                $this->locale,
                true
            );
            $this->postMessage(self::KIND_EVENTS, $message);
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.