	public static function filesBySearch($text, $wid=NULL, $orderby="name ASC")
	{
		global $DB;
		global $website;

		if(empty($wid))
			$wid = $website->id;

		$DB->query('  SELECT * FROM nv_files
					   WHERE name LIKE '.protect('%'.$text.'%').'
					     AND website = '.$wid.'
					ORDER BY '.$orderby);
					
		return $DB->result();		
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.