        $period_days_append_sql=  substr($period_days_append_sql,0,-4).'))';
    }
   
    $exist_RET=  DBGet(DBQuery("SELECT s.ID FROM schedule s WHERE student_id=".  $student_id." AND s.syear='".UserSyear()."' {$mp_append_sql}{$period_days_append_sql} UNION SELECT s.ID FROM temp_schedule s WHERE student_id=".  $student_id."{$mp_append_sql}{$period_days_append_sql}"));
    if($exist_RET)
        return 'There is a Period Conflict ('.$course_RET[1]['CP_TITLE'].')';
    else
    {
        return true;
    }
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.