	public static function load_object_strings($node_type, $node_id, $node_uid=null)
	{
		global $DB;
		
		$DB->query('
			SELECT subtype, lang, text
			  FROM nv_webdictionary
			 WHERE node_type = '.protect($node_type).'
			   AND node_id = '.protect($node_id).
            (empty($node_uid)? '' : ' AND ( node_uid = '.protect($node_uid).' OR node_uid = "" OR node_uid IS NULL )')
		);

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.