function clean_input_value($value) {
    if (is_string($value)) {
        return descript($value);
    }
    if (is_array($value)) {
        return array_map('descript', $value);
    }
    return '';
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.