TaintedHtml

User-controlled input reaches an HTML output sink without sanitization, creating a cross-site scripting (XSS) risk.

Example

<?php
echo $_GET['name']; // raw user input written to HTML

How to fix

Escape output with htmlspecialchars() before writing to HTML.

<?php
echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');