					open           : function() {
						var dw = dialog.width() - 20;
						(preview.width() > dw) && preview.width(dw);
						pwidth  = preview.width()  - (rhandle.outerWidth()  - rhandle.width());
						pheight = preview.height() - (rhandle.outerHeight() - rhandle.height());
						img.attr('src', src + (src.indexOf('?') === -1 ? '?' : '&')+'_='+Math.random());
						imgc.attr('src', img.attr('src'));
						imgr.attr('src', img.attr('src'));
					}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.