function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {
    $username = $input;

    $img_url = sigGetAvatarUrl($username);

    $o =  '<br>'
        . '<span class="scratch-sig">'
        . '<a href="/wiki/User:'.$username.'">'
        . '<img src="' . $img_url . '" width="18px" height="18px">'
        . '</a>'
        . ' '
        . '<a href="/wiki/User:'.$username.'">'
        . '<b>'.$username.'</b>'
        . '</a>'
        . ' '
        . '('
        . '<a href="/wiki/User_Talk:'.$username.'">talk</a>'
        . ' | '
        . '<a href="/wiki/Special:Contributions/'.$username.'">contribs</a>'
        . ')'
        . '</span>';

    return $o;
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.