                        echo '</SCHOOL_' . htmlentities($i) . '>';
                        $i++;
                    }
                    echo '</SCHOOL_ACCESS>';
                    //                }
                    echo '</STAFF_' . htmlentities($j) . '>';
                    $j++;
                }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.