    public function fetchRow($sql)
    {
        // retrieve row
        $query_id = $this->query($sql);

        $record = mysql_fetch_row($this->query_id);

        $this->freeResult($query_id);

        return $record;
    }#-#fetchRow()
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.