Request superglobal is echoed or printed without output encoding, enabling cross-site scripting.
Encode output with htmlspecialchars() using ENT_QUOTES before echoing user input.