		$fdat_value = htmlspecialchars(xss_clean($fdat_value));
		$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
		if($fdat_field != 'flt_keel') {?>
		<input type=hidden name="<?=$fdat_field?>" value="<?=$fdat_value?>">
	<?	}
	}?>

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.