	public static function loadElementPaths($type, $object_id, $website_id=null)
	{
		global $DB;
		global $website;

		if(empty($website_id))
			$website_id = $website->id;

		$ok = $DB->query('
			SELECT *
			  FROM nv_paths
			 WHERE type = '.protect($type).'
			   AND object_id = '.protect($object_id).'
			   AND website = '.$website_id
		);

	    if(!$ok)
		    throw new Exception($DB->get_last_error());
    
		$data = $DB->result();
		if(!is_array($data)) $data = array();
		
		$out = array();
		
		foreach($data as $item)
		{
			$out[$item->lang] = $item->path;
		}
		    		
		return $out;	
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.