function draw_vdef_preview($vdef_id) {
	?>
	<tr class='even'>
		<td style='padding:4px'>
			<pre>vdef=<?php print html_escape(get_vdef($vdef_id, true));?></pre>
		</td>
	</tr>
	<?php
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.