    public function validate($string, $config, $context) {

        $string = trim($string);

        // early abort: '' and '0' (strings that convert to false) are invalid
        if (!$string) return false;

        $pattern = '/^(-?[A-Za-z_][A-Za-z_\-0-9]*)$/';
        if (!preg_match($pattern, $string)) return false;
        return $string;

    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.