    public function asHtml(ElementNode $el)
    {
        if (!$this->hasValidInputs($el)) {
            return $el->getAsBBCode();
        }

        $html = $this->getReplacementText();

        if ($this->usesOption()) {
            $html = str_ireplace('{option}', $el->getAttribute(), $html);
        }

        if ($this->parseContent()) {
            $content = "";
            foreach ($el->getChildren() as $child)
                $content .= $child->getAsHTML();
        } else {
            $content = "";
            foreach ($el->getChildren() as $child)
                $content .= $child->getAsBBCode();
        }

        $html = str_ireplace('{param}', $content, $html);

        return $html;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.