	public function update()
	{
		global $DB;
	    
		$ok = $DB->execute(' 
 			UPDATE nv_menus
			   SET codename = :codename, icon = :icon, lid = :lid, notes = :notes, 
			   	   functions = :functions, enabled = :enabled
            WHERE id = :id',
			array(
				'id' => $this->id,
				'codename' => value_or_default($this->codename, ""),
				'icon' => value_or_default($this->icon, ""),
				'lid' => value_or_default($this->lid, 0),
				'notes' => value_or_default($this->notes, ""),
				'functions' => json_encode($this->functions),
				'enabled' => value_or_default($this->enabled, 0)
			)
        );
		
		if(!$ok)
			throw new Exception($DB->get_last_error());
		
		return true;
	}

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.