  def self.find_q_codes(html)

    q_hash = {}   # |q_code, q_param|

    return q_hash if html.nil?

    all = Research.get_q_codes

    q_codes = html.scan(/[$](q\d{2}_\d{2})/)

    unless q_codes.nil?

      yaml = Research.get_config_yaml

      q_codes.each do |q_code_a|

        q_code = q_code_a.first

        if all.include?(q_code)
          
          if yaml[q_code].nil?
            q_hash[q_code] = nil
          else
            q_hash[q_code] = Marshal.load(Marshal.dump(yaml[q_code]))
          end

        end
      end
    end

    return q_hash
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.