    private function insertElement($token, $append = true, $check = false) {
        // Proprietary workaround for libxml2's limitations with tag names
        if ($check) {
            // Slightly modified HTML5 tag-name modification,
            // removing anything that's not an ASCII letter, digit, or hyphen
            $token['name'] = preg_replace('/[^a-z0-9-]/i', '', $token['name']);
            // Remove leading hyphens and numbers
            $token['name'] = ltrim($token['name'], '-0..9');
            // In theory, this should ever be needed, but just in case
            if ($token['name'] === '') $token['name'] = 'span'; // arbitrary generic choice
        }
        
        $el = $this->dom->createElement($token['name']);

        foreach($token['attr'] as $attr) {
            if(!$el->hasAttribute($attr['name'])) {
                $el->setAttribute($attr['name'], $attr['value']);
            }
        }

        $this->appendToRealParent($el);
        $this->stack[] = $el;

        return $el;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.