	public static function object_votes_by_webuser($object, $object_id, $orderby='date desc', $offset=0, $limit=PHP_INT_MAX)
	{
		global $DB;
		global $website;
		
		$DB->queryLimit('wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username', 
						'nv_webuser_votes wuv, nv_webusers wu', 
						'	 wuv.website = '.protect($website->id).'
					   	 AND wuv.object  = '.protect($object).'
 					   	 AND wuv.object_id = '.protect($object_id).'
					   	 AND wu.id = wuv.webuser',
						$orderby, 
						$offset, 
						$limit);
					 				 
		return array($DB->result(), $DB->foundRows());
	}	

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.