                } elseif ($vars['paging'] < $limit  || $vars['paging'] = $limit) {
                    $prev = ($vars['paging']) - 1;
                    if ($smart == true) {
                        $url = $vars['url'].'/paging/'.$prev;
                    } else {
                        $url = $vars['url'].'&paging='.$prev;
                    }
                    $r .= "<li class=\"pull-left\"><a href=\"{$url}\">Previous</a></li>";
                }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.