                $val = self::escape($val);
                $set .= "'{$val}',";
                $k .= "`{$key}`,";
            }

            $set = substr($set, 0, -1);
            $k = substr($k, 0, -1);

            $sql = sprintf('INSERT INTO `%s` (%s) VALUES (%s) ', $vars['table'], $k, $set);
        } else {
            $sql = $vars;
        }
        if (DB_DRIVER == 'mysql') {
            mysql_query('SET CHARACTER SET utf8');
            $q = mysql_query($sql) or die(mysql_error());
            self::$last_id = mysql_insert_id();
        } elseif (DB_DRIVER == 'mysqli') {
            try {
                if (!self::query($sql)) {
                    // printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
                    //Control::error('db',self::$mysqli->error);
                    return false;
                } else {
                    self::$last_id = self::$mysqli->insert_id;

                    return true;
                }
            } catch (exception $e) {
                echo $e->getMessage();
            }
        }

        //return true;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.