    ${renderConfig(extendedOptions)}
    <div id="root" />
    <script type="text/javascript">
      window.addEventListener('load', function (event) {
        ${loading.script}
  
        const root = document.getElementById('root');
        root.classList.add('playgroundIn');
        const configText = document.getElementById('config').innerText
        if(configText && configText.length) {
          try {
            GraphQLPlayground.init(root, JSON.parse(configText))
          }
          catch(err) {
            console.error("could not find config")
          }
        }
      })
    </script>
  </body>
  </html>
`
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.