            function clean_data(data, text) {
                if (data === '') {
                    return text;
                } else {
                    return data.replace(/&#93;/g, ']')
                        .replace(/>/g, '&gt;').replace(/</g, '&lt;');
                }
            }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.