function escapeJsString(unsafe) {
    if (typeof(unsafe) != 'undefined') {
        return unsafe
            .toString()
            .replace("\000", '')
            .replace('\\', '\\\\')
            .replace('\'', '\\\'')
            .replace("&#039;", "\\\&#039;")
            .replace('"', '\"')
            .replace("&quot;", "\&quot;")
            .replace("\n", '\n')
            .replace("\r", '\r')
            .replace(/<\/script/gi, '</\' + \'script')
    } else {
        return false;
    }
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.