    public static function thmMenu(){
        $thm = Options::v('themes');
        //$mod = self::modList();
        //print_r($mod);
        $list = '';
        # code...
        $data = self::data($thm);
        if(isset($_GET['page'])
            && $_GET['page'] == 'themes'
            && isset($_GET['view'])
            && $_GET['view'] == 'options'){
            $class = 'class="active"';
        }else{
            $class = "";
        }
        if (self::optionsExist($thm)) {
            $active = (isset($_GET['page'])
                && $_GET['page'] == 'themes'
                && isset($_GET['view'])
                && $_GET['view']  == 'options')?"class=\"active\"":"";
            $list .= "
            <li $class>
                <a href=\"index.php?page=themes&view=options\" $active>".$data['icon']." ".$data['name']."</a>
            </li>";
        }else{
            $list = '';
        }

        return $list;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.