	public function setting($name, $value=NULL)
    {
        global $DB;
        global $website;

        $DB->query(
            'SELECT * 
             FROM nv_settings 
             WHERE  type = "user" AND 
                    user = '.protect($this->id).' AND
                    website = '.protect($website->id).' AND 
                    name = '.protect($name)
        );

        $setting = $DB->first();

        if(!isset($value))
        {
            if(!empty($setting))
                $value = $setting->value;
        }
        else
        {
            // replace setting value
            if(empty($setting))
            {
                $DB->execute('
                    INSERT INTO nv_settings
                       (id, website, type, user, name, value)
                     VALUES
                      (:id, :website, :type, :user, :name, :value)
                ', array(
                    ':id' => 0,
                    ':website' => $website->id,
                    ':type' => "user",
                    ':user' => $this->id,
                    ':name' => $name,
                    ':value' => $value
                ));
            }
            else
            {
                $DB->execute('
                    UPDATE nv_settings
                       SET value = :value
                     WHERE id = :id
                ', array(
                    ':id' => $setting->id,
                    ':value' => $value
                ));
            }
        }

        return $value;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.