	public static function update_object_score($object, $object_id)
	{
		global $DB;
		
		list($votes, $score) = webuser_vote::calculate_object_score($object, $object_id);		
		$table = array(
			'item'	=>	'nv_items',
			'structure'	=>	'nv_structure',
			'product' => 'nv_products'
		);

		if(empty($table[$object]))
			return false;
		
		$DB->execute('
			UPDATE '.$table[$object].' 
			   SET votes = '.protect($votes).',
			   	   score = '.protect($score).'
			 WHERE id = '.protect($object_id)
		);
		
		return true;		
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.