    private function _includeFiles($files)
    {
        $dynamic_scripts = "";
        $scripts = array();
        foreach ($files as $value) {
            if (strpos($value['filename'], "?") !== false) {
                $dynamic_scripts .= "<script type='text/javascript' src='js/"
                    . $value['filename'] . "'></script>";
                continue;
            }
            $include = true;
            if ($value['conditional_ie'] !== false
                && PMA_USR_BROWSER_AGENT === 'IE'
            ) {
                if ($value['conditional_ie'] === true) {
                    $include = true;
                } else if ($value['conditional_ie'] == PMA_USR_BROWSER_VER) {
                    $include = true;
                } else {
                    $include = false;
                }
            }
            if ($include) {
                $scripts[] = "scripts[]=" . $value['filename'];
            }
        }
        $separator = PMA_URL_getArgSeparator();
        $url = 'js/get_scripts.js.php'
            . PMA_URL_getCommon(array(), 'none')
            . $separator . implode($separator, $scripts);

        $static_scripts = sprintf(
            '<script type="text/javascript" src="%s"></script>',
            htmlspecialchars($url)
        );
        return $static_scripts . $dynamic_scripts;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.