    def test_get_form_without_help_text_escaping(self):
        response = self.client.get('/contact-us/')
        # HTML in help text should not be escaped
        self.assertContains(response, "<em>please</em> be polite")
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.