	public static function object_votes_by_score($object, $object_id)
	{
		global $DB;
		global $website;
		
		$DB->query('
			SELECT value, COUNT(*) as votes
			  FROM nv_webuser_votes
             WHERE website = '.protect($website->id).'
			   AND object  = '.protect($object).'
               AND object_id = '.protect($object_id).'
			 GROUP BY value
			 ORDER BY value ASC
		 ');
					 
		$data = $DB->result();
		
		return $data;
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.