    function makeHtml(data) {
        storage.get('mathjax', function(items) {
            // Convert MarkDown to HTML without MathJax typesetting.
            // This is done to make page responsiveness.  The HTML body
            // is replaced after MathJax typesetting.
            config.markedOptions.sanitize = items.mathjax ? false : true;
            marked.setOptions(config.markedOptions);
            var html = marked(data);
            $(document.body).html(html);

            $('img').on("error", function() {
                resolveImg(this);
            });

            // Apply MathJax typesetting
            if (items.mathjax) {
                $.getScript(chrome.extension.getURL('js/marked.js'));
                $.getScript(chrome.extension.getURL('js/highlight.js'), function() {
                    $.getScript(chrome.extension.getURL('js/config.js'));
                });

                // Create hidden div to use for MathJax processing
                var mathjaxDiv = $("<div/>").attr("id", config.mathjaxProcessingElementId)
                                    .text(data)
                                    .hide();
                $(document.body).append(mathjaxDiv);
                $.getScript(chrome.extension.getURL('js/runMathJax.js'));
            }
        });
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.