function cfdef_input_textbox( array $p_field_def, $p_custom_field_value, $p_required = '' ) {
	echo '<input ', helper_get_tab_index(), ' type="text" id="custom_field_', $p_field_def['id']
			, '" name="custom_field_', $p_field_def['id'], '" ', $p_required;
	if( $p_field_def['length_max'] > 0 ) {
		echo ' maxlength="' . $p_field_def['length_max'] . '"'
				, ' size="' .  min( 80, $p_field_def['length_max'] ) . '"';
	} else {
		echo ' maxlength="255" size="80"';
	}
	if( !empty( $p_field_def['valid_regexp'] ) ) {
		# the custom field regex is evaluated with preg_match and looks for a partial match in the string
		# however, the html property is matched for the whole string.
		# unless we have explicit start and end tokens, adapt the html regex to allow a substring match.
		$t_cf_regex = $p_field_def['valid_regexp'];
		if( substr( $t_cf_regex, 0, 1 ) != '^' ) {
			$t_cf_regex = '.*' . $t_cf_regex;
		}
		if( substr( $t_cf_regex, -1 ) != '$' ) {
			$t_cf_regex .= '.*';
		}
		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"';
	}
	echo ' value="' . string_attribute( $p_custom_field_value ) .'" />';
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.