    public static function update($vars)
    {
        if (is_array($vars)) {
            //print_r($vars);
            $u = $vars['user'];
            $sql = array(
                            'table' => 'user',
                            'id' => $vars['id'],
                            'key' => $u,
                        );
            Db::update($sql);
            if (isset($vars['detail']) && $vars['detail'] != '') {
                $u = $vars['detail'];
                $sql = array(
                                'table' => 'user_detail',
                                'id' => $vars['id'],
                                'key' => $u,
                            );
                Db::update($sql);
            }
            Hooks::run('user_sqledit_action', $vars);
        }
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.