succeeded; if the call failed, then the HANDLE-AFTER is to exit the loop.
In line 8, the code performs a CHECK-BEFORE to filter out dangerous HTML tags to
avoid cross-site scripting (CWE-79). However, this check is incomplete, to XSS is still
possible. If proper output encoding were used before the printf() in line 9, when this