    public function __construct($str)
    {
        $strStart = 0;
        for ($index = 0; $index < strlen($str); ++$index) {
            if (']' == $str[$index] || '[' == $str[$index]) {
                /* Are there characters in the buffer from a previous string? */
                if ($strStart < $index) {
                    array_push($this->tokens, substr($str, $strStart, $index - $strStart));
                    $strStart = $index;
                }

                /* Add the [ or ] to the tokens array. */
                array_push($this->tokens, $str[$index]);
                $strStart = $index+1;
            }
        }

        if ($strStart < strlen($str)) {
            /* There are still characters in the buffer. Add them to the tokens. */
            array_push($this->tokens, substr($str, $strStart, strlen($str) - $strStart));
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.