                $_result[$_key] = preg_replace("/<>'\"\[\]{}:;/", "", $_value);
            }
            $result  = $_result;
        } else {
            $_result = strip_tags($arr[$key]);
            $result  = preg_replace("/<>\`'\"\[\]{}():;/", "", $_result);
        }
    } else {
        $result = $def;
    }

    return $result;
}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.