					chk  = function(hash, tmb) {
						var node = $('#'+fm.cwdHash2Id(hash)),
							file;
	
						if (node.length) {
							if (fm.isInWindow(node, true)) {
								if (tmb != '1') {
									file = fm.file(hash);
									if (file.tmb == '1') {
										file.tmb = tmb;
									}
									(function(node, tmb) {
										$('<img/>')
											.on('load', function() { node.find('.elfinder-cwd-icon').addClass(tmb.className).css('background-image', "url('"+tmb.url+"')"); })
											.attr('src', tmb.url);
									})(node, fm.tmb(file));
								} else {
									bufferExt.getTmbs.push(hash);
								}
								done.push(hash);
							}
						}
					};
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.