                $new = $this->getClass($new, 'TagTransform_');
                $list[] = "<$old> with $new";
            }
            $ret .= $this->element('td', $this->listify($list));
        $ret .= $this->end('tr');

        $ret .= $this->start('tr');
            $ret .= $this->element('th', 'Pre-AttrTransform');
            $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_pre));
        $ret .= $this->end('tr');

        $ret .= $this->start('tr');
            $ret .= $this->element('th', 'Post-AttrTransform');
            $ret .= $this->element('td', $this->listifyObjectList($def->info_attr_transform_post));
        $ret .= $this->end('tr');

        $ret .= $this->end('table');
        return $ret;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.