		void CWebServer::RType_CustomLightIcons(WebEmSession & session, const request& req, Json::Value &root)
		{
			int ii = 0;

			std::vector<_tCustomIcon> temp_custom_light_icons = m_custom_light_icons;
			std::sort(temp_custom_light_icons.begin(), temp_custom_light_icons.end(), compareIconsByName);

			for (const auto & itt : temp_custom_light_icons)
			{
				root["result"][ii]["idx"] = itt.idx;
				root["result"][ii]["imageSrc"] = itt.RootFile;
				root["result"][ii]["text"] = itt.Title;
				root["result"][ii]["description"] = itt.Description;
				ii++;
			}
			root["status"] = "OK";
		}

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.