	public function load_from_resultset($rs)
	{
		global $DB;
		
		$main = $rs[0];
		
		$this->id      		= $main->id;
		$this->codename		= $main->codename;
		$this->icon		    = $main->icon;
   		$this->lid		    = $main->lid;    
   		$this->notes	    = $main->notes;    
		$this->enabled		= $main->enabled;
		
		/*
		$DB->query('SELECT function_id 
					  FROM nv_menu_items 
					 WHERE menu_id = '.$this->id.' ORDER BY position ASC');
					 
		$this->functions = $DB->result('function_id');
		*/
		$this->functions	= json_decode($main->functions);
		if(empty($this->functions))	$this->functions = array();		
	}

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.