	public static function update_object_votes($webuser, $object, $object_id, $value, $replace=false)
	{
		global $DB;
		global $website;
		global $events;

		$status = false;
		$voted = false;
		$webuser_vote_id = null;
		
		// user has voted in the past?
		if($DB->query('
				SELECT *
				  FROM nv_webuser_votes
				 WHERE webuser = '.intval($webuser).'
				   AND object  = '.protect($object).'
				   AND object_id = '.protect($object_id)
			)
		)
		{
			$data = $DB->result();
			$data = $data[0];
			$voted = ($data->webuser == $webuser);
			$webuser_vote_id = $data->id;
		}	

		if($voted && $replace) // update
		{
			$ok = $DB->execute('
 				UPDATE nv_webuser_votes
				   SET `value`	=  '.protect($value).',
						date 	=  '.protect(core_time()).'
				 WHERE id = '.$webuser_vote_id
			);
			
			if(!$ok)
				throw new Exception($DB->get_last_error());
			else
				$status = true;
		}
		else if($voted)
		{
			$status = 'already_voted';
		}
		else	// insert
		{
			$wv = new webuser_vote();
			$wv->website = $website->id;
			$wv->webuser = $webuser;			
			$wv->object  = $object;
			$wv->object_id = $object_id;
			$wv->value 	 = $value;
			$wv->insert();
			$webuser_vote_id = $wv->id;
			$status = true;
		}
		
		// now update the object score
		if($status === true)
			webuser_vote::update_object_score($object, $object_id);

		$events->trigger(
			'webuser',
			'vote',
			array(
				'status' => $status,
				'webuser_vote_id' => $webuser_vote_id,
				'webuser' => $webuser,
				'object' => $object,
				'object_id' => $object_id,
				'value' => $value,
				'replace' => $replace
			)
		);
		
		return $status;
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.