mechanism. For the same XSS problem, there is also a missing protection mechanism -
no encoding of the output (CWE-116) from the printf call in line 9.
For the uncontrolled format string (CWE-134) on line 9, the exposure of this string to
external input was probably entirely accidental due to the missing "%s" specifier.