function core_load_function($fid)
{
	global $DB;
    global $menu_layout;

    // check if fid is an internal function
    // or we need to retrieve its information from the database
    switch($fid)
    {
        case 'utils':
            $func = new stdClass();
            $func->id = 'utils';
            $func->codename = 'utils';
            $func->category = 'internal';
            $func->icon = '';
            $func->lid = '';
            $func->enabled = 1;
            break;

        case 'grid_notes':
            $func = new stdClass();
            $func->id = 'grid_notes';
            $func->codename = 'grid_notes';
            $func->category = 'content';
            $func->icon = '';
            $func->lid = '';
            $func->enabled = 1;
            break;

        case 'permissions':
            $func = new stdClass();
            $func->id = 'permissions';
            $func->codename = 'permissions';
            $func->category = 'config';
            $func->icon = '';
            $func->lid = '';
            $func->enabled = 1;
            break;

        default:
            if(is_numeric($fid))
                $where = 'id = '.intval($fid);
            else
                $where = 'codename = '.protect($fid);

            $DB->query('SELECT *
                          FROM nv_functions
                         WHERE '.$where.'
                           AND enabled = 1');

            $func = $DB->first();

            if(!$menu_layout->function_is_displayed($func->id))
                $func = false;
    }

    return $func;
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.