		filter = function(hashes) {
			var mixed  = false,
				croot  = '';
			
			if (fm.searchStatus.state > 1 && fm.searchStatus.target === '') {
				hashes = $.map(hashes, function(h) {
					return fm.isCommandEnabled('download', h)? h : null;
				});
				croot = fm.root(hashes[0]);
				$.each(hashes, function(i, h) {
					if (mixed = (croot !== fm.root(h))) {
						return false;
					}
				});
				zipOn = (!mixed && fm.command('zipdl') && fm.isCommandEnabled('zipdl', croot));
			} else {
				if (!fm.isCommandEnabled('download', hashes[0])) {
					return [];
				}
				zipOn = (fm.command('zipdl') && fm.isCommandEnabled('zipdl', hashes[0]));
			}
			
			return (!zipOn)?
					$.map(self.files(hashes), function(f) { return f.mime == 'directory' ? null : f; })
					: self.files(hashes);
		};
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.