	public function load_from_post()
	{
		$this->codename		= $_REQUEST['codename'];
		$this->icon		    = $_REQUEST['icon'];
   		$this->lid		    = $_REQUEST['lid']; 
   		$this->notes	    = $_REQUEST['notes']; 		   
		$this->enabled		= ($_REQUEST['enabled']=='1'? '1' : '0');
		
		// load associated functions
		$functions = explode('#', $_REQUEST['menu-functions']);
		$this->functions = array();
		foreach($functions as $function)
		{
			if(!empty($function))
				$this->functions[] = $function;
		}
	}	

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.