    var create_tag_html = function(text, description, id, parent_id,
                                   is_tagset) {
        var cls = is_tagset ? "alltags-tagset" :
            (parent_id ? "alltags-childtag" : "alltags-tag");
        var html = "<div class='" + cls + "' data-id='" + id + "'";
        if (parent_id) {
            html += " data-set='" + parent_id + "'";
        }
        if (id < 0) { // new tag, save description
            html += " data-description='" + description.escapeHTML() + "'";
        }
        html += ">" + text.escapeHTML() + "</div>";
        return html;
    };
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.