                $val = self::escape($val);
                $set .= "'{$val}',";
                $k .= "`{$key}`,";
            }
            
            $set = substr($set, 0,-1);
            $k = substr($k, 0,-1);
            
            $sql = sprintf("INSERT INTO `%s` (%s) VALUES (%s) ", $vars['table'], $k, $set) ;
        }else{
            $sql = $vars;
        }
        if(DB_DRIVER == 'mysql') {
            mysql_query('SET CHARACTER SET utf8');
            $q = mysql_query($sql) or die(mysql_error());
            self::$last_id = mysql_insert_id();
        }elseif(DB_DRIVER == 'mysqli'){
            try {
                if(!self::query($sql)){
                    // printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
                    //Control::error('db',self::$mysqli->error);
                    return false;
                }else{
                    self::$last_id = self::$mysqli->insert_id;
                    return true;
                }
                
            } catch (exception $e) {
                echo $e->getMessage();
            }
            
        }
        
        //return true;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.