		foreach($functions as $function)
		{		
			if($function->id == $f)
			{
				if($function->enabled=='1')
					$sortable_assigned[] = '<li class="ui-state-highlight" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
				else
					$sortable_assigned[] = '<li class="ui-state-highlight ui-state-disabled" value="'.$function->id.'" category="'.$function->category.'"><img src="'.NAVIGATE_URL.'/'.$function->icon.'" align="absmiddle" /> '.t($function->lid, $function->lid).'</li>';
			}			
		}

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.