    public static function thmMenu()
    {
        $thm = Options::v('themes');
        //$mod = self::modList();
        //print_r($mod);
        $list = '';
        # code...
        if (User::access(0)) {
            $data = self::data($thm);
            if (isset($_GET['page'])
                && $_GET['page'] == 'themes'
                && isset($_GET['view'])
                && $_GET['view'] == 'options') {
                $class = 'class="active"';
            } else {
                $class = '';
            }
            if (self::optionsExist($thm)) {
                $active = (isset($_GET['page'])
                    && $_GET['page'] == 'themes'
                    && isset($_GET['view'])
                    && $_GET['view']  == 'options') ? 'class="active"' : '';
                $list .= "
                <li $class>
                    <a href=\"index.php?page=themes&view=options\" $active>".$data['icon'].' '.$data['name'].'</a>
                </li>';
            } else {
                $list = '';
            }
        }

        return $list;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.