            $this->emitToken(array(
                'type' => self::CHARACTR,
                'data' => $char
            ));

        /* U+003C LESS-THAN SIGN (<) */
        } elseif($char === '<' && ($this->content_model === self::PCDATA ||
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.