            success: function (message) {
                input.replaceWith('<span data-tag-id="' + id + '">' + input.val().replace(/\//g, '&#x2F;') + '</span>');
                $('span[data-tag-id="' + id + '"]');
                $('#saving_data_indicator').html(message);
            }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.