def pref_set(key, value):
    if get_user() is None:
        return "Authentication required", 401

    get_preferences()[key] = (None if value == 'null' else value)
    return Response(json.dumps({'key': key, 'success': ''})), 201
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.