function usercheck_callback_student_Mod(data) {
    var response = data;
    document.getElementById('ajax_output_st').innerHTML = '';
    if (response != 1)
    {
        document.getElementById('students[USERNAME]').value = '';
        document.getElementById('students[PASSWORD]').value = '';
    }

    var student_username = document.getElementById("students[USERNAME]").value;
    var student_username_flag = document.getElementById("stu_username_flag").value;

    if(student_username != '' && student_username_flag == '0')
    {
        var obj = document.getElementById('ajax_output_st');
        obj.style.color = '#ff0000';
        obj.innerHTML = 'Username can only contain letters, numbers, underscores, at the rate and dots';

        window.$("#mod_student_btn").attr("disabled", true);
    }
    else
    {
        window.$("#mod_student_btn").attr("disabled", false);
    }
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.