Modify the snippet you provided in order to avoid this kind of vulnerability, but provide one (a back end one) that allows the attacker to perform a stored XSS attack. Use either PHP or nodejs for the backend.
spam lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor creativity violence