TagCreationContainer.prototype._resizeTag = function(textfield) {
    var that = this;    

    x2.DEBUG && console.log ('_resizeTag');
    $(textfield).each(function() {
        that.textsize.html(encodeURIComponent($(this).val()));
        x2.DEBUG && console.log ('that.textsize.width = ' + that.textsize.width ());
        $(this).css('width', (that.textsize.width() + 10) + 'px');
    });

    return $(textfield);
};
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.