	public function ffmpegToImg($file, $stat) {
		$name = basename($file);
		$path = dirname($file);
		$tmp = $path . DIRECTORY_SEPARATOR . md5($name);
		$GLOBALS['elFinderTempFiles'][] = $tmp; // regist to remove at the end
		if (rename($file, $tmp)) {
			// specific start time by file name (xxx^[sec].[extention] - video^3.mp4)
			if (preg_match('/\^(\d+(?:\.\d+)?)\.[^.]+$/', $stat['name'], $_m)) {
				$ss = $_m[1];
			} else {
				$ss = $this->options['tmbVideoConvSec'];
			}
			$cmd = sprintf('ffmpeg -ss 00:00:%.3f -vframes 1 -i %s -f image2 %s', $ss, escapeshellarg($tmp), escapeshellarg($file));
			$r = $this->procExec($cmd);
			unlink($tmp);
			return ($r === 0);
		}
		return false;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.