Language: PHP
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
    public function checkForDuplicates($prefix)
    {
        global $local_log;
        require_once('include/formbase.php');
    
        $focus = BeanFactory::newBean('Prospects');
        if (!checkRequired($prefix, array_keys($focus->required_fields))) {
            return null;
        }
        $query = '';
        $baseQuery = 'select id,first_name, last_name, title, email1, email2  from prospects where deleted!=1 and (';
        if (!empty($_POST[$prefix.'first_name']) && !empty($_POST[$prefix.'last_name'])) {
            $query = $baseQuery ."  (first_name like '". $_POST[$prefix.'first_name'] . "%' and last_name = '". $_POST[$prefix.'last_name'] ."')";
        } else {
            $query = $baseQuery ."  last_name = '". $_POST[$prefix.'last_name'] ."'";
        }
        if (!empty($_POST[$prefix.'email1'])) {
            if (empty($query)) {
                $query = $baseQuery. "  email1='". $_POST[$prefix.'email1'] . "' or email2 = '". $_POST[$prefix.'email1'] ."'";
            } else {
                $query .= "or email1='". $_POST[$prefix.'email1'] . "' or email2 = '". $_POST[$prefix.'email1'] ."'";
            }
        }
        if (!empty($_POST[$prefix.'email2'])) {
            if (empty($query)) {
                $query = $baseQuery. "  email1='". $_POST[$prefix.'email2'] . "' or email2 = '". $_POST[$prefix.'email2'] ."'";
            } else {
                $query .= "or email1='". $_POST[$prefix.'email2'] . "' or email2 = '". $_POST[$prefix.'email2'] ."'";
            }
        }

        if (!empty($query)) {
            $rows = array();
        
            $db = DBManagerFactory::getInstance();
            $result = $db->query($query.');');
            while ($row = $db->fetchByAssoc($result)) {
                $rows[] = $row;
            }
            if (count($rows) > 0) {
                return $rows;
            }
        }
        return null;
    }