                $content = ($vars['excerpt'] === true) ? substr(
                    strip_tags(
                        Typo::Xclean($p->content)
                    ),
                    0,
                    $excerptMax
                ) : '';

                echo '<li class="'.$liClass.'">';
                echo (isset($vars['title']) && $vars['title'] === true) ? '<h4 class="'.$h4Class.'"><a href="'.Url::post($p->id)."\">{$p->title}</a></h4>" : '';
                echo (isset($vars['date']) && $vars['date'] === true) ? '<small>posted on : '.Date::local($p->date).' </small> ' : '';
                echo (isset($vars['author']) && $vars['author'] === true) ? '<small>by : '.$p->author.'</small>' : '';
                echo (isset($vars['excerpt']) && $vars['excerpt'] === true) ? '<p class="'.$pClass.'">'.$content.'</p>' : '';
                echo '</li>';
            }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.