def _keyify(key):
    key = escape(key.lower(), quote=True)
    return _key_pattern.sub(' ', key)
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.