			$stat = $this->stat($p);

			if (!$stat) { // invalid links
				continue;
			}

			if (!empty($stat['hidden']) || !$this->mimeAccepted($stat['mime'], $mimes)) {
				continue;
			}
			
			$name = $stat['name'];

			if ($this->doSearchCurrentQuery['excludes']) {
				foreach($this->doSearchCurrentQuery['excludes'] as $exclude) {
					if ($this->stripos($name, $exclude) !== false) {
						continue 2;
					}
				}
			}

			if ((!$mimes || $stat['mime'] !== 'directory') && $this->stripos($name, $q) !== false) {
				$stat['path'] = $this->path($stat['hash']);
				if ($this->URL && !isset($stat['url'])) {
					$path = str_replace($this->separator, '/', substr($p, strlen($this->root) + 1));
					if ($this->encoding) {
						$path = str_replace('%2F', '/', rawurlencode($this->convEncIn($path, true)));
					}
					$stat['url'] = $this->URL . $path;
				}
				
				$result[] = $stat;
			}
			if ($stat['mime'] == 'directory' && $stat['read'] && !isset($stat['alias'])) {
				if (! $this->options['searchExDirReg'] || ! preg_match($this->options['searchExDirReg'], $p)) {
					$result = array_merge($result, $this->doSearch($p, $q, $mimes));
				}
			}
		}
		
		return $result;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.