function edit($selected_events, $queue)
{
	global $database_ged;

	// get all needed infos into variables
	$value_parts = explode(":", $selected_events);
	$id = $value_parts[0];
	$ged_type = $value_parts[1];

	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
	$event = mysqli_fetch_assoc($result);

	$event["comments"] = str_replace("\'", "'", $event["comments"]);
	$event["comments"] = str_replace("\#", "#'", $event["comments"]);

	echo "
	<form id='edit-event-form'>
		<div class='form-group'>
			<label>".getLabel("label.add_comment")."</label>
			<textarea id='event-comments' class='form-control textarea' rows='10'>".$event["comments"]."</textarea>
		</div>
	</form>";
}
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.