    public function testUnclosedTag()
    {
        $code = 'hello [b]world';
        $html = 'hello <strong>world</strong>';
        $this->assertProduces($code, $html);
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.