                   foreach($gc as $gcc=>$gcd)
                   {
                       if($gcd!='' && $gcc!='GRADE_LEVEL')
                       {
                       $sql_columns[]=$gcc;
                       $sql_values[]="'".$gcd."'";
                       }
                       if($gcd!='' && $gcc=='GRADE_LEVEL')
                       {
                           foreach($get_cs_grade as $gcsgi=>$gcsgd)
                           {
                            if($gcd==$gcsd['ID']) 
                            {
                            
                            $sql_columns[]='GRADE_LEVEL';
                            $sql_values[]="'".$get_ts_grade[$gcsgi]['ID']."'";
                            
                            }
                           }
                       }
                   }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.