function nvweb_content_comments_count($object_id = NULL, $object_type = "item")
{
	global $DB;
	global $website;
	global $current;

    $element = $current['object'];
    if($current['type']=='structure' && $object_type == "item")
        $element = $element->elements(0); // item = structure->elements(first)

	if(empty($object_id))
		$object_id = $element->id;

	$DB->query('SELECT COUNT(*) as total
				  FROM nv_comments
				 WHERE website = '.protect($website->id).'
				   AND object_type = "'.$object_type.'"
				   AND object_id = '.protect($object_id).'
				   AND status = 0'
				);
													
	$out = $DB->result('total');
	
	return $out[0];
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.