    public function afterSave($event) {
        // look up current tags
        $oldTags = $this->getTags();
        $newTags = array();

        foreach ($this->scanForTags() as $tag) {
            if (!in_array($tag, $oldTags)) { // don't add duplicates if there are already tags
                $tagModel = new Tags;
                $tagModel->tag = $tag;  // includes the #
                $tagModel->type = get_class($this->getOwner());
                $tagModel->itemId = $this->getOwner()->id;
                $tagModel->itemName = $this->getOwner()->name;
                $tagModel->taggedBy = Yii::app()->getSuName();
                $tagModel->timestamp = time();
                if ($tagModel->save())
                    $newTags[] = $tag;
            }
        }
        $this->_tags = $newTags + $oldTags; // update tag cache

        if (!empty($newTags) && $this->flowTriggersEnabled) {
            X2Flow::trigger('RecordTagAddTrigger', array(
                'model' => $this->getOwner(),
                'tags' => $newTags,
            ));
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.