    public function validate($string, $config, $context) {

        $string = trim($string);
        if ($string === '') return false;

        $parent_result = parent::validate($string, $config, $context);
        if ($parent_result !== false) return $parent_result;

        $length = strlen($string);
        $last_char = $string[$length - 1];

        if ($last_char !== '%') return false;

        $points = substr($string, 0, $length - 1);

        if (!is_numeric($points)) return false;

        $points = (int) $points;

        if ($points < 0) return '0%';
        if ($points > 100) return '100%';

        return ((string) $points) . '%';

    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.