    private function writeComment(Worksheet $pSheet, $coordinate)
    {
        $result = '';
        if (!$this->isPdf && isset($pSheet->getComments()[$coordinate])) {
            $result .= '<a class="comment-indicator"></a>';
            $result .= '<div class="comment">' . nl2br($pSheet->getComment($coordinate)->getText()->getPlainText()) . '</div>';
            $result .= PHP_EOL;
        }

        return $result;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.