        $file = sprintf('%s/%s.class.php', $path, $class_name);
        if (is_file($file))
        {
            include_once $file;
        }

    }
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.