	protected function getItemsInHand($hashes, $dir = null) {
		static $totalSize = 0;
		if (is_null($dir)) {
			$totalSize = 0;
			if (! $tmpDir = $this->getTempPath()) {
				return false;
			}
			$dir = tempnam($tmpDir, 'elf');
			if (!unlink($dir) || !mkdir($dir, 0700, true)) {
				return false;
			}
			register_shutdown_function(array($this, 'rmdirRecursive'), $dir);
		}
		$res = true;
		$files = array();
		foreach ($hashes as $hash) {
			if (($file = $this->file($hash)) == false) {
				continue;
			}
			if (!$file['read']) {
				continue;
			}
			
			$name = $file['name'];
			// for call from search results
			if (isset($files[$name])) {
				$name = preg_replace('/^(.*?)(\..*)?$/', '$1_'.$files[$name]++.'$2', $name);
			} else {
				$files[$name] = 1;
			}
			$target = $dir.DIRECTORY_SEPARATOR.$name;
			
			if ($file['mime'] === 'directory') {
				$chashes = array();
				$_files = $this->scandir($hash);
				foreach($_files as $_file) {
					if ($file['read']) {
						$chashes[] = $_file['hash'];
					}
				}
				if ($chashes) {
					mkdir($target, 0700, true);
					$res = $this->getItemsInHand($chashes, $target);
				}
				if (!$res) {
					break;
				}
				!empty($file['ts']) && @touch($target, $file['ts']);
			} else {
				$path = $this->decode($hash);
				if ($fp = $this->fopenCE($path)) {
					if ($tfp = fopen($target, 'wb')) {
						$totalSize += stream_copy_to_stream($fp, $tfp);
						fclose($tfp);
					}
					!empty($file['ts']) && @touch($target, $file['ts']);
					$this->fcloseCE($fp, $path);
				}
				if ($this->options['maxArcFilesSize'] > 0 && $this->options['maxArcFilesSize'] < $totalSize) {
					$res = $this->setError(elFinder::ERROR_ARC_MAXSIZE);
				}
			}
		}
		return $res? $dir : false;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.