            var fillTable = function(chart_data) {

                var tableRows = [],
                    rowData, rowId;
                for(i=0; i<chart_data.length; i++) {
                    rowData = chart_data[i];
                    rowId = typeof rowData.userId != 'undefined' ? rowData.userId : rowData.groupId;
                    tableRows.push('<tr><td class="link">' + rowData.label.escapeHTML() + '(id:'+ rowId +')</td>');
                    tableRows.push('<td class="link">' + rowData.data.filesizeformat() + '</td></tr>');
                }
                
                $('#drivespaceTable tbody').html(tableRows.join(""));
                $('#drivespaceTable').show();
            };
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.