    function selectObject($table, $where) {
        $where = $this->injectProof($where);
        $res = mysqli_query($this->connection, "SELECT * FROM `" . $this->prefix . "$table` WHERE $where LIMIT 0,1");
        if ($res == null)
            return null;
        return mysqli_fetch_object($res);
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.