    public static function flag($vars)
    {
        switch (SMART_URL) {
            case true:
                $lang = '?lang='.$vars;
                if (isset($_GET['lang'])) {
                    $uri = explode('?', $_SERVER['REQUEST_URI']);
                    $uri = $uri[0];
                } else {
                    $uri = $_SERVER['REQUEST_URI'];
                }
                $url = $uri.$lang;

                break;

            default:
                // print_r($_GET);
                if (!empty($_GET)) {
                    $val = '';
                    foreach ($_GET as $key => $value) {
                        if ($key == 'lang') {
                            $val .= '&lang='.$vars;
                        } else {
                            $val .= $key.'='.$value;
                        }
                    }
                } else {
                    $val = 'lang='.$vars;
                }
                $lang = !isset($_GET['lang']) ? '&lang='.$vars : $val;
                $url = Site::$url.'/?'.$lang;
                break;
        }

        return $url;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.