    public static function getFolder() {
        $uri = explode('/', Site::$url);

        if(count($uri) > 3) {

            unset($uri[0]);
            unset($uri[1]);
            unset($uri[2]);

            $uri = array_values($uri);

            $uris = "";
            for($i=0; $i<count($uri); $i++){
                $uris .= "/".$uri[$i];
            }
            return $uris;

        }else{

            return "/";

        }
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.