	public static function calculate_object_score($object, $object_id)
	{
		global $DB;
		global $website;
				
		$DB->query('SELECT COUNT(*) as votes, SUM(value) as score
					  FROM nv_webuser_votes
					 WHERE object_id = '.protect($object_id).'
					   AND object = '.protect($object).'
					   AND website = '.$website->id);	
					   
		$data = $DB->first();
		
		return array($data->votes, $data->score);
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.