	public function delete()
	{
		global $DB;
        global $user;
        global $events;

        $ok = false;

        if($user->permission("themes.delete")=="false")
            throw new Exception(t(610, "Sorry, you are not allowed to execute this function."));

        if(file_exists(NAVIGATE_PATH.'/plugins/'.$this->code.'/'.$this->code.'.plugin'))
        {
            core_remove_folder(NAVIGATE_PATH.'/plugins/'.$this->code);

            $ok = $DB->execute('
                DELETE FROM nv_extensions
                 WHERE id = '.protect($this->id)
            );

            if(method_exists($events, 'trigger'))
            {
                $events->trigger(
                    'extension',
                    'delete',
                    array(
                        'extension' => $this
                    )
                );
            }
        }

        return $ok;
	
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.