function createDialog(id, title, legend, content, positionClass) {
    if (!positionClass)
        positionClass = "left";
    var newDialog = createElement("div", id, ["dialog", positionClass]);
    newDialog.setStyle({"display": "none"});

    if (positionClass == "none") {
        var bgDiv = $("bgDialogDiv");
        if (bgDiv) {
            bgDiv.show();
        }
        else {
            bgDiv = createElement("div", "bgDialogDiv", ["bgDialog"]);
            document.body.appendChild(bgDiv);
            //bgDiv.observe("click", disposeDialog);
        }
    }

    var subdiv = createElement("div", null, null, null, null, newDialog);
    if (title && title.length > 0) {
        var titleh3 = createElement("h3", null, null, null, null, subdiv);
        titleh3.update(title);
    }
    if (legend) {
        if (Object.isElement(legend))
            subdiv.appendChild(legend);
        else if (legend.length > 0) {
            var legendP = createElement("p", null, null, null, null, subdiv);
            legendP.appendChild(document.createTextNode(legend));
        }
    }
    if (content)
        subdiv.appendChild(content);
    createElement("hr", null, null, null, null, subdiv);

    return newDialog;
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.