function PMA_getColumnsList($db, $from=0, $num=25)
{
    $cfgCentralColumns = PMA_centralColumnsGetParams();
    if (empty($cfgCentralColumns)) {
        return array();
    }
    $pmadb = $cfgCentralColumns['db'];
    $GLOBALS['dbi']->selectDb($pmadb, $GLOBALS['controllink']);
    $central_list_table = $cfgCentralColumns['table'];
    //get current values of $db from central column list
    if ($num == 0) {
        $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
    } else {
        $query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
            . 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
            . 'LIMIT ' . $from . ', ' . $num . ';';
    }
    $has_list = (array) $GLOBALS['dbi']->fetchResult(
        $query, null, null, $GLOBALS['controllink']
    );
    PMA_handleColumnExtra($has_list);
    return $has_list;
}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.