3. CWE-79 : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
MIT-28 While it is risky to use dynamically-generated query strings, code, or commands that mix control and data
together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters
within those arguments. The most conservative approach is to escape or filter all characters that do not pass