should not be.
For cross-site scripting (CWE-79), the test in line 8 assumes that the printf() in line 9 is
only using TRUSTED data. However, the test did not consider all possible inputs that
provide EQUIVALENT scripting capabilities, such as "<sCrIpT>" which is equivalent to