to create their own messages without doing any proper validation or encoding, then a
variety of strings could modify the intended structure. Even a tag such as "<sCrIpT>"
would not be caught by the case-sensitive comparison in line 8. As a result, at line 9,
the program can include unexpected scripting syntax in its output to the web browser,