function usercheck_callback_s(data) {
    var response = (data == 1);

    var obj = document.getElementById('ajax_output_2');
    obj.style.color = (response) ? '#008800' : '#ff0000';
    obj.innerHTML = (response == 1) ? 'Username Available' : 'Username already taken';

    var staff_username = document.getElementById("USERNAME").value;
    var staff_username_flag = document.getElementById("staff_username_flag").value;

    if(staff_username != '' && staff_username_flag == '0')
    {
        var obj = document.getElementById('ajax_output_1');
        obj.style.color = '#ff0000';
        obj.innerHTML = 'Username can only contain letters, numbers, underscores, at the rate and dots';

        window.$("#mod_staff_btn").attr("disabled", true);
    }
    else
    {
        window.$("#mod_staff_btn").attr("disabled", false);
    }
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.