	function qstr($s, $magic_quotes = false)
	{
		if (!$magic_quotes) {
			if ($this->_connectionID) {
				return $this->_connectionID->quote($s);
			}
			return "'" . str_replace("'", $this->replaceQuote, $s) . "'";
		}

		// undo magic quotes for "
		$s = str_replace('\\"', '"', $s);
		return "'$s'";
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.