	protected function _save($fp, $dir, $name, $stat) {
		$path = $this->_joinPath($dir, $name);

		$meta = stream_get_meta_data($fp);
		$uri = isset($meta['uri'])? $meta['uri'] : '';
		if ($uri && ! preg_match('#^[a-zA-Z0-9]+://#', $uri)) {
			@fclose($fp);
			$isCmdPaste = ($this->ARGS['cmd'] === 'paste');
			$isCmdCopy = ($isCmdPaste && empty($this->ARGS['cut']));
			if (($isCmdCopy || !@rename($uri, $path)) && !@copy($uri, $path)) {
				return false;
			}
			// re-create the source file for remove processing of paste command
			$isCmdPaste && !$isCmdCopy && touch($uri);
		} else {
			if (@file_put_contents($path, $fp, LOCK_EX) === false) {
				return false;
			}
		}

		@chmod($path, $this->options['fileMode']);
		clearstatcache();
		return $path;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.