function PMA_getUrlParams(
    $what, $reload, $action, $db, $table, $selected, $views,
    $original_sql_query, $original_url_query
) {
    $_url_params = array(
        'query_type' => $what,
        'reload' => (! empty($reload) ? 1 : 0),
    );
    if (mb_strpos(' ' . $action, 'db_') == 1) {
        $_url_params['db']= $db;
    } elseif (mb_strpos(' ' . $action, 'tbl_') == 1
        || $what == 'row_delete'
    ) {
        $_url_params['db']= $db;
        $_url_params['table']= $table;
    }
    foreach ($selected as $sval) {
        if ($what == 'row_delete') {
            $_url_params['selected'][] = 'DELETE FROM '
                . PMA\libraries\Util::backquote($table)
                . ' WHERE ' . $sval . ' LIMIT 1;';
        } else {
            $_url_params['selected'][] = $sval;
        }
    }
    if ($what == 'drop_tbl' && !empty($views)) {
        foreach ($views as $current) {
            $_url_params['views'][] = $current;
        }
    }
    if ($what == 'row_delete') {
        $_url_params['original_sql_query'] = $original_sql_query;
        if (! empty($original_url_query)) {
            $_url_params['original_url_query'] = $original_url_query;
        }
    }

    return  $_url_params;
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.