    public static function webuser_comments_count($webuser_id)
    {
        global $DB;
        global $website;

        $DB->query('  
            SELECT COUNT(*) AS total 
            FROM nv_comments 
            WHERE website = '.protect($website->id).' 
            AND user = '.protect($webuser_id).'
            AND status = 0'
        );

        $out = $DB->result('total');
        if(is_array($out))
            $out = $out[0];

        return $out;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.