   	function injectProof($string) {
   	    $quotes = substr_count("'", $string);
        if ($quotes % 2 != 0)
            $string = $this->escapeString($string);
        $dquotes = substr_count('"', $string);
        if ($dquotes % 2 != 0)
            $string = $this->escapeString($string);
        return $string;
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.