                        echo '</SCHOOL_' . htmlentities($i) . '>';
                        $i++;
                    }
                    echo '</SCHOOL_ACCESS>';
                    //                }
                    echo '</STAFF_' . htmlentities($j) . '>';
                    $j++;
                }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.