	public static function email_verification($email, $hash)
	{
		global $DB;

		$status = false;

		if(strpos($hash, "-") > 0)
        {
            list($foo, $expiry) = explode("-", $hash);
            if(time() > $expiry)
            {
                // expired unconfirmed account!
                return $status;
            }
        }

		$DB->query('
			SELECT id, activation_key
			  FROM nv_webusers
			 WHERE email = '.protect($email).'
			   AND activation_key = '.protect($hash).'
		');
		$rs = $DB->first();

		if(!empty($rs->id))
		{
			$wu = new webuser();
			$wu->load($rs->id);

			// access is only enabled for blocked users (access==1) which don't have a password nor an email verification date
			if($wu->access==1 && empty($wu->password) && empty($wu->email_verification_date))
			{
				// email is confirmed through a newsletter subscribe request
				$wu->email_verification_date = time();
				$wu->access = 0;
				$wu->activation_key = "";
				$status = $wu->save();
			}
		}

		return $status;
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.