    public static function find($code)
    {
        global $DB;
        global $website;

        $DB->query('
            SELECT * 
            FROM nv_coupons 
            WHERE website = '.protect($website->id).' AND
                  code = '.protect($code),
            'object'
        );

        $rs = $DB->result();
        $out = false;

        if(!empty($rs))
        {
            $coupon = new coupon();
            $coupon->load_from_resultset($rs);
            $out = $coupon;
        }

        return $out;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.