        me.moveAttachmentTo = function($element, label)
        {
            // move elemement to new place
            $attachmentLink.appendTo($element);

            // update text - ensuring no HTML is inserted into the text node
            I18n._(
                $attachmentLink,
                $('<div />').text(label).html(),
                $('<div />').text($attachmentLink.attr('download')).html()
            );
        };
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.