	public function execute()
	{
		// call parent, this will probably add some general CSS/JS or other required files
		parent::execute();

		// get parameters
		$term = SpoonFilter::getPostValue('term', null, '');
		$limit = (int) FrontendModel::getModuleSetting('search', 'autocomplete_num_items', 10);

		// validate
		if($term == '') $this->output(self::BAD_REQUEST, null, 'term-parameter is missing.');

		// get matches
		$matches = FrontendSearchModel::getStartsWith($term, FRONTEND_LANGUAGE, $limit);

		// get search url
		$url = FrontendNavigation::getURLForBlock('search');

		// loop items and set search url
		foreach($matches as &$match) $match['url'] = $url . '?form=search&q=' . $match['term'];

		// output
		$this->output(self::OK, $matches);
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.