    public static function delete($id){
        $id = sprintf('%d', $id);
        $parent = self::getParent($id);

        $sql = array(
                    'table' => 'cat',
                    'where' => array(
                                    'id' => $id
                                )
                );
        $cat = Db::delete($sql);
        if($cat){
            return true;
        }else{
            return false;
        }
        // check all posts with this category and move to parent categories
        $post = Db::result("SELECT `id` FROM `posts` 
                            WHERE `cat` = '{$id}'");
        $npost = Db::$num_rows;
        
        //print_r($parent);
        if($npost > 0){
            $sql = "UPDATE `posts` 
                    SET `cat` = '{$parent[0]->parent}' 
                    WHERE `cat` = '{$id}'";
            Db::query($sql);
        }
        
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.