        $input = (function ($settingName, $setting, $appView) {
            $settingId = str_replace('.', '_', $settingName);
            return $this->Bootstrap->switch([
                'label' => h($setting['description']),
                'checked' => !empty($setting['value']),
                'id' => $settingId,
                'class' => [
                    (!empty($setting['error']) ? 'is-invalid' : ''),
                    (!empty($setting['error']) ? $appView->get('variantFromSeverity')[$setting['severity']] : ''),
                ],
                'attrs' => [
                    'data-setting-name' => $settingName
                ]
            ]);
        })($settingName, $setting, $this);
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.