                    : htmlspecialchars($host['User'])) . '</label></td>' . "\n"
                . '<td>' . htmlspecialchars($host['Host']) . '</td>' . "\n";

            $html_output .= '<td>';

            $password_column = 'Password';

            $check_plugin_query = "SELECT * FROM `mysql`.`user` WHERE "
                . "`User` = '" . $host['User'] . "' AND `Host` = '"
                . $host['Host'] . "'";
            $res = $GLOBALS['dbi']->fetchSingleRow($check_plugin_query);

            if ((isset($res['authentication_string'])
                && ! empty($res['authentication_string']))
                || (isset($res['Password'])
                && ! empty($res['Password']))
            ) {
                $host[$password_column] = 'Y';
            } else {
                $host[$password_column] = 'N';
            }

            switch ($host[$password_column]) {
            case 'Y':
                $html_output .= __('Yes');
                break;
            case 'N':
                $html_output .= '<span style="color: #FF0000">' . __('No')
                    . '</span>';
                break;
            // this happens if this is a definition not coming from mysql.user
            default:
                $html_output .= '--'; // in future version, replace by "not present"
                break;
            } // end switch

            $html_output .= '</td>' . "\n";

            $html_output .= '<td><code>' . "\n"
                . '' . implode(',' . "\n" . '            ', $host['privs']) . "\n"
                . '</code></td>' . "\n";
            if ($cfgRelation['menuswork']) {
                $html_output .= '<td class="usrGroup">' . "\n"
                    . (isset($group_assignment[$host['User']])
                        ? $group_assignment[$host['User']]
                        : ''
                    )
                    . '</td>' . "\n";
            }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.