		filter = function(hashes, inExec) {
			var czipdl = (fm.api > 2)? fm.command('zipdl') : null,
				mixed  = false,
				croot  = '';
			
			if (czipdl !== null && fm.searchStatus.state > 1 && fm.searchStatus.target === '') {
				croot = fm.root(hashes[0]);
				$.each(hashes, function(i, h) {
					if (mixed = (croot !== fm.root(h))) {
						return false;
					}
				});
			}
			zipOn = (! mixed && czipdl !== null && fm.isCommandEnabled('zipdl', hashes[0]));

			if (mixed) {
				hashes = $.map(hashes, function(h) {
					return fm.isCommandEnabled('download', h)? h : null;
				});
			} else {
				if (!fm.isCommandEnabled('download', hashes[0])) {
					return [];
				}
			}
			
			return $.map(self.files(hashes), function(f) { 
				inExec && ! f.read && $('#' + fm.cwdHash2Id(f.hash)).trigger('unselect');
				return (! f.read || (! zipOn && f.mime == 'directory')) ? null : f;
			});
		};
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.