    function ac_sigleid($name, $id) {
        global $cms_db, $sess;

        $sess->gc( true );
        $ret = true;
        if( $id >= 1 ) {
            $ret = false;
            $cquery = sprintf("select count(*) from %s where user_id='%s' and name='%s'",
                $cms_db['sessions'],
                addslashes($id),
                addslashes($name));
            $squery = sprintf("select sid from %s where user_id='%s' and name='%s'",
                $cms_db['sessions'],
                addslashes($id),
                addslashes($name));
            $this->db->query($squery);
            if ( $this->db->affected_rows() == 0
                && $this->db->query($cquery)
    	        && $this->db->next_record() && $this->db->f(0) == 0 ) {
                // nothing found here
                $ret = true;
            }
        }
        return $ret;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.