    def receivePing():
        vrequest = request.form['id']
        db.sentences_victim('report_online', [vrequest], 2)
        return json.dumps({'status' : 'OK', 'vId' : vrequest});
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.