                $content = ($vars['excerpt'])? substr(
                    strip_tags(
                        Typo::Xclean($p->content)
                    ), 0, $excerptMax): "";

                echo "<li class=\"".$liClass."\">
                    <h4 class=\"".$h4Class."\"><a href=\"".Url::post($p->id)."\">{$p->title}</a></h4>
                    <p class=\"".$pClass."\">".$content."</p>
                </li>";
            }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.