	public static function countries($lang="", $alpha3=false)
	{
		global $DB;
        global $user;

        // static function can be called from navigate or from a webget (user then is not a navigate user)
		if(empty($lang))
			$lang = $user->language;

        $code = 'country_code';
        if($alpha3)
            $code = 'alpha3';

		$DB->query('SELECT '.$code.' AS country_code, name
					FROM nv_countries
		 			WHERE lang = '.protect($lang).'
					ORDER BY name ASC');
					
		$rs = $DB->result();
		
		if(empty($rs))
		{
			// failback, load English names	
			$DB->query('SELECT '.$code.' AS country_code, name
						FROM nv_countries
						WHERE lang = "en"
						ORDER BY name ASC');
						
			$rs = $DB->result();
		}
		
		$out = array();
		
		foreach($rs as $country)
		{
			$out[$country->country_code] = $country->name;	
		}
		
		return $out;
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.