    public function actionAppendTag() {
        if (isset($_POST['Type'], $_POST['Id'], $_POST['Tag']) &&
                preg_match('/^[\w\d_-]+$/', $_POST['Type'])) {

            if (!class_exists($_POST['Type'])) {
                echo 'false';
                return;
            }
            $model = X2Model::model($_POST['Type'])->findByPk($_POST['Id']);
            echo $model->addTags($_POST['Tag']);
            exit;
            if ($model !== null && $model->addTags($_POST['Tag'])) {
                echo 'true';
                return;
            }
        }
        echo 'false';
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.