                }elseif($vars['paging'] < $limit  || $vars['paging'] = $limit ){
                    $prev = ($vars['paging'])-1;
                    if($smart == true){
                    $url = $vars['url']."/paging/".$prev;
                    }else{
                        $url = $vars['url']."&paging=".$prev;
                    }
                    $r .= "<li class=\"pull-left\"><a href=\"{$url}\">Previous</a></li>";
                }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.