		helper     : function(e, ui) {
			var element = this.id ? $(this) : $(this).parents('[id]:first'),
				helper  = $('<div class="elfinder-drag-helper"><span class="elfinder-drag-helper-icon-status"/></div>'),
				icon    = function(f) {
					var mime = f.mime, i;
					i = '<div class="elfinder-cwd-icon '+self.mime2class(mime)+' ui-corner-all"/>';
					if (f.tmb && f.tmb !== 1) {
						i = $(i).css('background', "url('"+self.option('tmbUrl')+f.tmb+"') center center no-repeat").get(0).outerHTML;
					}
					return i;
				},
				hashes, l, ctr;
			
			self.draggingUiHelper && self.draggingUiHelper.stop(true, true);
			
			self.trigger('dragstart', {target : element[0], originalEvent : e});
			
			hashes = element.hasClass(self.res('class', 'cwdfile')) 
				? self.selected() 
				: [self.navId2Hash(element.attr('id'))];
			
			helper.append(icon(files[hashes[0]])).data('files', hashes).data('locked', false).data('droped', false).data('namespace', self.namespace).data('dropover', 0);

			if ((l = hashes.length) > 1) {
				helper.append(icon(files[hashes[l-1]]) + '<span class="elfinder-drag-num">'+l+'</span>');
			}
			
			$(document).on(keydown + ' keyup.' + namespace, function(e){
				var chk = (e.shiftKey||e.ctrlKey||e.metaKey);
				if (ctr !== chk) {
					ctr = chk;
					if (helper.is(':visible') && helper.data('dropover') && ! helper.data('droped')) {
						helper.toggleClass('elfinder-drag-helper-plus', helper.data('locked')? true : ctr);
						self.trigger(ctr? 'unlockfiles' : 'lockfiles', {files : hashes, helper: helper});
					}
				}
			});
			
			return helper;
		}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.