                            $property->value[$lang] = theme::import_sample_translate_nv_urls($pvalue, $structure, $items);
                        }
                    }
                    else if(!is_string($property->value))  // ignore numeric values
                    {
                        $property->value = theme::import_sample_translate_nv_urls($property->value, $structure, $items);
                    }
            }

            $el_properties_associative[$property->id] = $property->value;
        }

        if(!empty($el_properties_associative))
        {
            if($el=='block_group_block')
            {
                $template = $real[$el_id]->code;
            }
            else if($el=='block')
            {
                $template = $real[$el_id]->type;
            }
            else
            {
                $template = $real[$el_id]->template;

                if(empty($template) && $el == 'item' && $real[$el_id]->embedding == 1)
                {
                    // we have to get the template set in the category of the item
                    $template = $DB->query_single(
                        'template',
                        'nv_structure',
                        ' id = '.protect($real[$el_id]->category).' AND 
								  website = '.$ws->id
                    );
                }
            }

            property::save_properties_from_array($el, $real[$el_id]->id, $template, $el_properties_associative, $ws, $item_uid);
        }
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.