                formatItem: function(data) {
                    var s = data[options.nameKey],
                        desc;

                    if (options.descKey) {
                        desc = $('<div/>').text(data[options.descKey]).html();
                        s += " <span>(" + desc + ")</span>";
                    }

                    return s;
                },
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.