   private function getCriterionValue($value) {
      if ($value instanceof \AbstractQuery) {
         return $value->getQuery();
      } else if ($value instanceof \QueryExpression) {
         return $value->getValue();
      } else if (DBmysql::isNameQuoted($value)) { //FIXME: database related
         return $value;
      } else if ($value instanceof \QueryParam) {
         return $value->getValue();
      } else {
         return $this->analyseCriterionValue($value);
      }
   }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.