                    $this->emitToken(array(
                        'type' => self::CHARACTR,
                        'data' => '<>'
                    ));

                    $this->state = 'data';

                } elseif($char === '?') {
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.