				doScan = function(items, isEntry) {
					var dirReader, entry;
					entries = [];
					var length = items.length;
					for (var i = 0; i < length; i++) {
						if (! isEntry) {
							entry = !!items[i].getAsEntry? items[i].getAsEntry() : items[i].webkitGetAsEntry();
						} else {
							entry = items[i];
						}
						if (entry) {
							if (entry.isFile) {
								processing++;
								entry.file(function (file) {
									paths.push('');
									files.push(file);
									processing--;
								});
							} else if (entry.isDirectory) {
								if (fm.api >= 2.1) {
									if (processing > 0) {
										dirctorys.push(entry);
									} else {
										processing = 0;
										dirReader = entry.createReader();
										processing++;
										readEntries(dirReader);
									}
								}
							}
						}
					}
				};
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.