function nvweb_menu_load_routes()
{
	global $DB;	
	global $structure;
	global $current;
	global $website;
			
	if(empty($structure['routes']))
	{
		$structure['routes'] = array();

		$DB->query('SELECT object_id, path
					  FROM nv_paths 
					 WHERE type = "structure"
					   AND lang = '.protect($current['lang']).'
					   AND website = '.$website->id);		
					
		$data = $DB->result();
		
		if(!is_array($data)) $data = array();
		$dictionary = array();
		
		foreach($data as $item)
		{
			$structure['routes'][$item->object_id] = $item->path;
		}			
	}
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.