            foreach ($criteria as $criterion) {
               // recursive call
               if (isset($criterion['criteria'])) {
                  return $check_criteria($criterion['criteria']);
               }

               if (!isset($criterion['field']) || !isset($criterion['searchtype'])
                   || !isset($criterion['value'])) {
                  return __("Malformed search criteria");
               }

               if (!ctype_digit((string) $criterion['field'])
                   || !array_key_exists($criterion['field'], $soptions)) {
                  return __("Bad field ID in search criteria");
               }

               if (isset($soptions[$criterion['field']])
                   && isset($soptions[$criterion['field']]['nosearch'])
                   && $soptions[$criterion['field']]['nosearch']) {
                  return __("Forbidden field ID in search criteria");
               }
            }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.