    public static function find_by_reference($reference, $website_id=null)
    {
        global $DB;
        global $website;

        if(empty($website_id))
            $website_id = $website->id;

        $order_id = $DB->query_single(
            'id',
            'nv_orders',
            'reference = '.protect($reference).' AND website = "'.$website_id.'"'
        );

        return $order_id;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.