function phoromatic_webui_header($left_items, $right = null)
{
	$ret = PHP_EOL . '<div id="pts_phoromatic_top_header">
	<ul>
	<li><a href="?"><img style="vertical-align: middle;" class="img_logo_pg" src="images/phoromatic_logo.svg" /></a>';

	if(isset($_SESSION['AdminLevel']) &&$_SESSION['AdminLevel'] > 0 && isset($_SESSION['AccountID']) && !empty($_SESSION['AccountID']))
	{
		$ret .= '<ul id="pts_phoromatic_info">';
		$ret .= '<li><a class="ph_date" href="#">' . date('H:i T - j F') . '</a></li>';
		$group_name = phoromatic_account_id_to_group_name($_SESSION['AccountID']);
		if($group_name != null)
		{
			$ret .= '<li><a href="#">' . $group_name . '</a></li>';
		}
		$ret .= '</ul>';
	}
	$ret .= '</li>';


	//$ret .= '<ul>';
	foreach($left_items as $i => $item)
	{
		if(is_array($item))
		{
			$ret .= '<li>' . $i;

			if(!empty($item))
			{
				$ret .= '<ul>';
				foreach($item as $sub_item)
				{
					$ret .= '<li>' . $sub_item . '</li>';
				}
				$ret .= '</ul>';
			}
			$ret .= '</li>' . PHP_EOL;
		}
		else
		{
			$ret .= '<li>' . $item . '</li>' . PHP_EOL;
		}
	}
	$ret .= '<li><div id="phoromatic_result_selected_info_box"></div> <a href="#" onclick="javascript:phoromatic_generate_comparison(\'?result/\');"><div id="phoromatic_result_compare_info_box">Compare</div></a> <a href="#" onclick="javascript:phoromatic_delete_results(\'?results/delete/\'); return false;"><div id="phoromatic_result_delete_box">Delete</div></a></li>';
	$ret .= '</ul>';

	if($right != null)
	{
		$ret .= '<div id="pts_phoromatic_top_header_right">' . $right .'</div>';
	}

	$ret .=' </div>';

	return $ret;
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.