    public static function add($tags) {

        $tag = explode(",", $tags);
        foreach ($tag as $t) {
            if (self::exist($t)) {
                return false;
            }else{
                $slug = Typo::slugify(Typo::cleanX($t));
                $cat = Typo::cleanX($t);
                $tag = Db::insert(
                            sprintf("INSERT INTO `cat` VALUES (null, '%s', '%s', '%d', '', 'tag' )",
                                $cat, $slug, 0
                            )
                        );
                return true;
            }
        }


    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.