    public function actionGetItems(){
        $model = X2Model::model ($this->modelClass);
        if (isset ($model)) {
            list ($accessCond, $params) = $model->getAccessSQLCondition ();
            $tableName = $model->tableName ();
            $sql = 
                'SELECT id, fileName as value
                 FROM '.$tableName.' 
                 WHERE associationType!="theme" and fileName LIKE :qterm AND '.$accessCond.' AND
                    (uploadedBy=:username OR private=0 OR private=NULL)
                 ORDER BY fileName ASC';
            $command = Yii::app()->db->createCommand($sql);
            $qterm = $_GET['term'].'%';
            $params[':qterm'] = $qterm;
            $params[':username'] = Yii::app()->user->getName ();
            $result = $command->queryAll(true, $params);
            echo CJSON::encode($result);
        }
        Yii::app()->end();
    }
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.