    public static function Xclean($vars)
    {
        $var = htmlspecialchars_decode($vars, ENT_QUOTES | ENT_HTML5);
        // $var = html_entity_decode($vars);
        return $var;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.