										data        : $.extend({cmd : cmd, name : name, target : phash}, data || {}), 
										notify      : {type : cmd, cnt : 1},
										preventFail : true,
										syncOnFail  : true
									})
									.fail(function(error) {
										dfrd.reject(error);
									})
									.done(function(data) {
										dfrd.resolve(data);
										if (data.added && data.added[0]) {
											var dirhash = data.added[0].hash,
												newItem = cwd.find('#'+fm.cwdHash2Id(dirhash));
											if (sel) {
												fm.exec('paste', dirhash);
											}
											if (newItem.length) {
												newItem.trigger('scrolltoview');
											}
										}
									});
							})
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.