    public static function remove_properties($element_type, $element_id, $website_id)
    {
        global $DB;
        global $website;

        if(empty($website_id))
            $website_id = $website->id;

        webdictionary::save_element_strings('property-'.$element_type, $element_id, array());

        $DB->execute('
            DELETE FROM nv_properties_items
                  WHERE website = '.$website_id.'
                    AND element = '.protect($element_type).'
                    AND node_id = '.intval($element_id).'
        ');
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.