    public function display_sdm_upload_meta_box($post) {  // File Upload metabox
	$old_upload = get_post_meta($post->ID, 'sdm_upload', true);
	$old_value = isset($old_upload) ? $old_upload : '';

	_e('Manually enter a valid URL of the file in the text box below, or click "Select File" button to upload (or choose) the downloadable file.', 'simple-download-monitor');
	echo '<br /><br />';

	echo '<div class="sdm-download-edit-file-url-section">';
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . $old_value . '" placeholder="http://..." />';
	echo '</div>';

	echo '<br />';
	echo '<input id="upload_image_button" type="button" class="button-primary" value="' . __('Select File', 'simple-download-monitor') . '" />';

	echo '<br /><br />';
	_e('Steps to upload a file or choose one from your media library:', 'simple-download-monitor');
	echo '<ol>';
	echo '<li>Hit the "Select File" button.</li>';
	echo '<li>Upload a new file or choose an existing one from your media library.</li>';
	echo '<li>Click the "Insert" button, this will populate the uploaded file\'s URL in the above text field.</li>';
	echo '</ol>';

	wp_nonce_field('sdm_upload_box_nonce', 'sdm_upload_box_nonce_check');
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.