	public function load_by_hash($hash)
	{
		global $DB;
		global $session;
        global $events;

        $ok = $DB->query('SELECT * FROM nv_webusers WHERE cookie_hash = '.protect($hash));
        if($ok)
            $data = $DB->result();

        if(!empty($data))
		{
			$this->load_from_resultset($data);

			// check if the user is still allowed to sign in
			$blocked = 1;
			if( $this->access == 0 ||
                ( $this->access == 2 &&
                    ($this->access_begin==0 || $this->access_begin < time()) &&
                    ($this->access_end==0 || $this->access_end > time())
                )
            )
			{
				$blocked = 0;
			}

			if($blocked==1)
				return false;

			$session['webuser'] = $this->id;

            // maybe this function is called without initializing $events
            if(method_exists($events, 'trigger'))
            {
                $events->trigger(
                    'webuser',
                    'sign_in',
                    array(
                        'webuser' => $this,
                        'by' => 'cookie'
                    )
                );
            }
		}

	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.