	protected function _fopen($path, $mode='rb') {
		// try ftp stream wrapper
		if ($this->options['mode'] == 'passive' && ini_get('allow_url_fopen')) {
			$url = 'ftp://'.$this->options['user'].':'.$this->options['pass'].'@'.$this->options['host'].':'.$this->options['port'].$path;
			if (strtolower($mode[0]) === 'w') {
				$context = stream_context_create(array('ftp' => array('overwrite' => true)));
				$fp = fopen($url, $mode, false, $context);
			} else {
				$fp = fopen($url, $mode);
			}
			if ($fp) {
				return $fp;
			}
		}
		
		if ($this->tmp) {
			$local = $this->getTempFile($path);
			$fp = fopen($local, 'wb');
			if (ftp_fget($this->connect, $fp, $path, FTP_BINARY)) {
				fclose($fp);
				$fp = fopen($local, $mode);
				return $fp;
			}
			fclose($fp);
			is_file($local) && unlink($local);
		}
		
		return false;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.