    public static function normalizeTag ($tag, $suppressHash=false) {
        $tag = trim($tag);      
        if (strpos ($tag, self::DELIM) !== false) {
            $tag = strtr($tag,array(self::DELIM => ''));
        }
        if(substr($tag,0,1) !== '#' && !$suppressHash) // make sure they have the hash
            $tag = '#'.$tag;
        if (substr ($tag, 0, 1) === '#' && $suppressHash) {
            $tag = preg_replace ('/^#/', '', $tag);
        }
        return $tag;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.