	public function query($sql, $fetch_mode='object')
	{
		$this->lastError = '';
		$this->lastResult = '';

		switch($fetch_mode)
		{
			case 'array':
				$fetch = PDO::FETCH_ASSOC;
				break;
			
			case 'object':
			default:
				$fetch = PDO::FETCH_OBJ;		
				break;	
		}

		try
		{
			$statement = $this->db->query($sql);
			$this->queries_count++;

			// avoid firing a fatal error exception when the result is NULL
            // and the query is not malformed
			if(!$statement)
                return false;

			$statement->setFetchMode($fetch);
			$this->lastResult = $statement->fetchAll();
			$statement->closeCursor();
			unset($statement);
		}
		catch(PDOException $e)
		{
			$this->lastError = $e->getMessage();
		}
		catch(Exception $e)
		{
			return false;
		}		
		
		return empty($this->lastError);	
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.