	public function tmb($hash) {
		$path = $this->decode($hash);
		$stat = $this->stat($path);
		
		if (isset($stat['tmb'])) {
			$res = $stat['tmb'] == "1" ? $this->createTmb($path, $stat) : $stat['tmb'];
			if (! $res) {
				list($type) = explode('/', $stat['mime']);
				$fallback = $this->options['resourcePath'] . DIRECTORY_SEPARATOR . strtolower($type) . '.png';
				if (is_file($fallback)) {
					$res = $this->tmbname($stat);
					if (! copy($fallback, $this->tmbPath . DIRECTORY_SEPARATOR . $res)) {
						$res = false;
					}
				}
			}
			return $res;
		}
		return false;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.