    public function testUnsubTokenReplacement () {
        $admin = Yii::app()->settings;
        $admin->externalBaseUrl = 'http://examplecrm.com';
        $admin->externalBaseUri = '/X2Engine';
        $cmb = $this->instantiate();
        $contact = $this->contacts('testUser_unsent');
        $campaign = $this->campaign('unsubToken');
        list($subject,$message,$uniqueId) = $cmb->prepareEmail($campaign,$contact);

        // Insert unsubscribe link(s):
        $unsubUrl = Yii::app()->createExternalUrl('/marketing/marketing/click', array(
            'uid' => $uniqueId,
            'type' => 'unsub',
            'email' => $contact->email
        ));
        $unsubLinkText = Yii::app()->settings->doNotEmailLinkText;
        $expectedLink = 
            '<a href="'.$unsubUrl.'">'.Yii::t('marketing', $unsubLinkText).'</a>';

        $this->assertRegExp(
            '/'.preg_quote($expectedLink, '/').'/', $message, 'Unsubscribe link not inserted');
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.