		dropUpload = function(e) {
			e.stopPropagation();
			e.preventDefault();
			var file = false,
				type = '',
				elfFrom = null,
				mycwd = '',
				data = null,
				target = e._target || null;
			try { elfFrom = e.dataTransfer.getData('elfinderfrom'); } catch(e) {}
			if (elfFrom) {
				mycwd = window.location.href + fm.cwd().hash;
				if ((!target && elfFrom === mycwd) || target === mycwd) {
					dfrd.reject();
					return;
				}
			}
			try{
				data = e.dataTransfer.getData('text/html');
				if (!data.match(/<(?:img|a)/i)) {
					data = '';
				}
			} catch(e) {}
			if (data) {
				file = [ data ];
				type = 'html';
			} else if (e.dataTransfer && e.dataTransfer.items &&  e.dataTransfer.items.length) {
				file = e.dataTransfer;
				type = 'data';
			} else if (e.dataTransfer && e.dataTransfer.files &&  e.dataTransfer.files.length) {
				file = e.dataTransfer.files;
				type = 'files';
			} else if (data = e.dataTransfer.getData('text')) {
				file = [ data ];
				type = 'text';
			}
			if (file) {
				fmUpload({files : file, type : type, target : target});
			} else {
				dfrd.reject();
			}
		};
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.