function createWhereClause($owner, $filter, $search, $daterange, $ok, $warning, $critical, $unknown)
{
	$where_clause = "";
	
	// owner
	if($owner == "owned"){ $where_clause .= " AND owner != ''"; }
	elseif($owner == "not owned"){ $where_clause .= " AND owner = ''"; }

	// advanced search (with *)
	if($search != ""){
		$like = "";
		if( substr($search, 0, 1) === '*' ){
			$like .= "%";
		}
		$like .= trim($search, '*');
		if ( substr($search, -1) === '*' ) {
			$like .= "%";
		}

		$where_clause .= " AND $filter LIKE '$like'";
	}

	// daterange
	if($daterange != ""){
		$daterange_parts = explode(" - ", $daterange);
		$start = $daterange_parts[0];
		$end = $daterange_parts[1];

		// modify start and end timestamp (1 Jan 1970 = -3600).
		// perhaps a little bug from DateRangePicker
		$start = strtotime($start);
		$start += 3600;
		$end = strtotime($end);
		$end += 86400 + 3600;
		$where_clause .= " AND o_sec > $start AND o_sec < $end";
	}

	// states
	$states_list = "";
	if($ok != "")		{ $states_list .= "0,"; }
	if($warning != "")	{ $states_list .= "1,"; }
	if($critical != "")	{ $states_list .= "2,"; }
	if($unknown != "")	{ $states_list .= "3,"; }
	$states_list = trim($states_list, ",");
	
	if($states_list != ""){
		$where_clause .= " AND state IN ($states_list)";
	}

	$where_clause .= " ORDER BY o_sec DESC LIMIT 500";
	return $where_clause;
}
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.