	public function query_single($column, $table, $where = '1=1', $order = '')
	{
	    $rs = null;
        if(!empty($order))
            $order = ' ORDER BY '.$order;

        try
        {
            $stm = $this->db->query('SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1');
            $this->queries_count++;
            $stm->setFetchMode(PDO::FETCH_NUM);
            $rs = $stm->fetchAll();
            $stm->closeCursor();
            unset($stm);
        }
        catch(Exception $e)
        {
            return NULL;
        }

		if(empty($rs)) 	return NULL;
		else			return $rs[0][0];
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.