function nvweb_dictionary_load()
{
	global $DB;
	global $session;
	global $website;
	global $theme;
	
	$dictionary = array();	
	// the dictionary is an array merged from the following sources (- to + preference)
	// theme dictionary (json)
	// theme dictionary on database
	// webdictionary custom entries
	
	// theme dictionary
	if(!empty($theme))
	{
		$theme->dictionary = array(); // clear previous loaded dictionary
		$theme->t(); // force theme dictionary load
	}
	
	if(!empty($theme->dictionary))
		$dictionary = $theme->dictionary;

	// webdictionary custom entries
	$DB->query('SELECT node_id, text
				  FROM nv_webdictionary 
				 WHERE node_type = "global"
				   AND lang = '.protect($session['lang']).'
				   AND website = '.$website->id.'
				 UNION
				 SELECT subtype AS node_id, text
				 FROM nv_webdictionary
				 WHERE node_type = "theme"
				   AND theme = '.protect($website->theme).' 
				   AND lang = '.protect($session['lang']).'
				   AND website = '.$website->id
			   );		
						
	$data = $DB->result();
	
	if(!is_array($data)) $data = array();
	
	foreach($data as $item)
	{
		$dictionary[$item->node_id] = $item->text;
	}
	
	return $dictionary;
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.