	public function load_template()
	{
		global $DB;
		global $website;
		
		$template = new template();	
		
		if(	$this->association == 'free' ||
			($this->association == 'category' && $this->embedding == '0'))
		{
			$template->load($this->template);	
		}
		else
		{
			$category_template = $DB->query_single(
                'template',
                'nv_structure',
                ' id = '.protect($this->category).' AND website = '.$website->id
            );
			$template->load($category_template);
		}
		
		return $template;
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.