    public static function recent($vars) {

        $catW = isset($vars['cat'])? " AND `cat` = '".$vars['cat']:"";
        $type = isset($vars['type'])? $vars['type']: "post";
        $num = isset($vars['num'])? $vars['num']: "10";
        $sql = "SELECT * FROM `posts`
                WHERE `type` = '{$type}' $catW AND `status` = '1'
                ORDER BY `date` DESC LIMIT {$num}";
        $posts = Db::result($sql);
        if(isset($posts['error'])){
            $posts['error'] = "No Posts found.";
        }else{
            $posts = self::prepare($posts);
        }
        return $posts;
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.