function nvweb_menu_load_actions()
{
	global $DB;	
	global $structure;
	global $current;
	global $website;
			
	if(empty($structure['actions']))
	{
		$structure['actions'] = array();

		$DB->query('
            SELECT node_id, subtype, text
			  FROM nv_webdictionary 
			 WHERE node_type = "structure"
			   AND lang = '.protect($current['lang']).'
			   AND subtype IN("action-type", "action-jump-item", "action-jump-branch", "action-new-window")
			   AND website = '.$website->id
        );
					
		$data = $DB->result();
		
		if(!is_array($data))
		    $data = array();

		foreach($data as $row)
		{
			$structure['actions'][$row->node_id][$row->subtype] = $row->text;
		}
	}
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.