    public static function theme($var, $data='') {
        if (isset($data)) {
            # code...
            $GLOBALS['data'] = $data;
        }
        if (self::exist($var)) {
            include(GX_THEME.THEME.'/'.$var.'.php');
        }else{
            Control::error('unknown','Theme file is missing.');
        }

    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.