exports.onAccountGetDepositAddress = async function(req, res)
{
    const dataParsed = url.parse(req.url);
    if (!dataParsed || !dataParsed.query || !req.headers['apisign'])
        return onError(req, res, 'Bad request');

    const queryStr = querystring.parse(dataParsed.query);
    if (!queryStr.apikey || !queryStr.nonce || !queryStr.currency)
        return onError(req, res, 'Bad request. Required parameter (apikey or nonce or currency) not found.');
    
    const coin = utils.GetCoinFromTicker(queryStr.currency); //, coin => {
        if (!coin || !coin.name) 
            return onError(req, res, 'Coin ticker not found');

        var fullUrl = req.protocol + '://' + req.get('host') + req.originalUrl;
    
        CheckAPIkey(queryStr.apikey, req.headers['apisign'], fullUrl, ret => {
            try
            {
                if (ret.success == false) throw new Error(ret.message);
                if (ret.key.read == 0) throw new Error('apikey disabled for read');
                    
                wallet.GetAccountAddress(ret.key.userid, coin.name, ret => {
                    if (ret.result != 'success' || !ret.data) 
                        return onError(req, res, ret.message);

                    onSuccess(req, res, {Currency: coin.ticker, Address: ret.data});
                });
            }
            catch(e) {
                return onError(req, res, e.message);
            }
        })
    //});    
}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.