    public static function create($vars) {
        if(is_array($vars)){
            
            //print_r($vars['user']);
            $u = $vars['user'];
            $sql = array(
                            'table' => 'user',
                            'key' => $u,
                        );
            $db = Db::insert($sql);

            if(!isset($vars['detail']) || $vars['detail'] == ''){
                Db::insert("INSERT INTO `user_detail` (`userid`) VALUES ('{$vars['user']['userid']}')");
            }else{
                $u = $vars['detail'];
                $sql = array(
                                'table' => 'user_detail',
                                'key' => $u,
                            );
                Db::insert($sql);
            }
            Hooks::run('user_sqladd_action', $vars);
        }

        return $db;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.