    public function make($string) {
        if ($string === '') $max = null;
        else $max = (int) $string;
        $class = get_class($this);
        return new $class($max);
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.