    public static function set_session($vars) {
        if (is_array($vars)) {
            if(is_array($_SESSION['gxsess']['val'])){
                $arr = array_merge($_SESSION['gxsess']['val'], $vars);
                $_SESSION['gxsess']['val'] = $arr;
            }else{
                $_SESSION['gxsess']['val'] = $vars;
            }

           

        }


    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.