    public function testValidation () {
        $contact = $this->contacts ('testAnyone');
        $tag = new Tags ();
        $tag->setAttributes (array (
            'itemId' => $contact->id,
            'type' => get_class ($contact),
            'itemName' => $contact->name,
            'tag' => 'test',
            'taggedBy' => 'testuser',
        ));
        $this->assertSaves ($tag);
        // ensure that normalization was performed upon validation
        $this->assertEquals (Tags::normalizeTag ('test'), $tag->tag);

        // ensure that tag must be unique
        $tag = new Tags ();
        $tag->setAttributes (array (
            'itemId' => $contact->id,
            'type' => get_class ($contact),
            'itemName' => $contact->name,
            'tag' => 'test',
            'taggedBy' => 'testuser',
        ));
        $tag->validate ();
        $this->assertTrue ($tag->hasErrors ('tag'));

        // ensure that tag must be unique
        $tag = new Tags ();
        $tag->setAttributes (array (
            'itemId' => $contact->id,
            'type' => get_class ($contact),
            'itemName' => $contact->name,
            'tag' => '#test',
            'taggedBy' => 'testuser',
        ));
        $tag->validate ();
        $this->assertTrue ($tag->hasErrors ('tag'));

        // ensure that tag must be unique
        $tag = new Tags ();
        $tag->setAttributes (array (
            'itemId' => $contact->id,
            'type' => get_class ($contact),
            'itemName' => $contact->name,
            'tag' => '#test,',
            'taggedBy' => 'testuser',
        ));
        $tag->validate ();
        $this->assertTrue ($tag->hasErrors ('tag'));
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.