        foreach ($cf_d as $cfd_i => $cfd_d) {
            if ($cfd_i == 'TYPE') {
                $fc = substr($cfd_d, 0, 1);
                $lc = substr($cfd_d, 1);
                $cfd_d = strtoupper($fc) . $lc;
                $get_schools_cf[$cf_i][$cfd_i] = $cfd_d;
                unset($fc);
                unset($lc);
            }
            if ($cfd_i == 'SELECT_OPTIONS' && $cf_d['TYPE'] != 'text') {

                for ($i = 0; $i < strlen($cfd_d); $i++) {
                    $char = substr($cfd_d, $i, 1);
                    if (ord($char) == '13')
                        $char = '<br/>';
                    $new_char[] = $char;
                }

                $cfd_d = implode('', $new_char);
                $get_schools_cf[$cf_i][$cfd_i] = $cfd_d;
                unset($char);
                unset($new_char);
            }
            if ($cfd_i == 'SYSTEM_FIELD' || $cfd_i == 'REQUIRED') {
                if ($cfd_d == 'N')
                    $get_schools_cf[$cf_i][$cfd_i] = 'No';
                if ($cfd_d == 'Y')
                    $get_schools_cf[$cf_i][$cfd_i] = 'Yes';
            }
        }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.