    public function display_sdm_thumbnail_meta_box($post) {  // Thumbnail upload metabox
	$old_thumbnail = get_post_meta($post->ID, 'sdm_upload_thumbnail', true);
	$old_value = isset($old_thumbnail) ? $old_thumbnail : '';
	_e('Manually enter a valid URL, or click "Select Image" to upload (or choose) the file thumbnail image.', 'simple-download-monitor');
	?>
	<br /><br />
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo $old_value; ?>" placeholder="http://..." />
	<br /><br />
	<input id="upload_thumbnail_button" type="button" class="button-primary" value="<?php _e('Select Image', 'simple-download-monitor'); ?>" />
	<input id="remove_thumbnail_button" type="button" class="button" value="<?php _e('Remove Image', 'simple-download-monitor'); ?>" />
	<br /><br />

	<span id="sdm_admin_thumb_preview">
	    <?php
	    if (!empty($old_value)) {
		?><img id="sdm_thumbnail_image" src="<?php echo $old_value; ?>" style="max-width:200px;" />
		<?php
	    }
	    ?>
	</span>

	<?php
	echo '<p class="description">';
	_e('This thumbnail image will be used to create a fancy file download box if you want to use it.', 'simple-download-monitor');
	echo '</p>';

	wp_nonce_field('sdm_thumbnail_box_nonce', 'sdm_thumbnail_box_nonce_check');
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.