    public static function background($item_type, $item_id, $color)
    {
        global $DB;
        global $website;
        global $user;

        $DB->execute('
            INSERT INTO nv_notes
                (id, website, user, item_type, item_id, background, note, date_created)
                VALUES
                (   0, :website, :user, :item_type, :item_id, :background, :note, :date_created   )',
            array(
                ':website' => $website->id,
                ':user' => value_or_default($user->id, 0),
                ':item_type' => value_or_default($item_type, ''),
                ':item_id' => value_or_default($item_id, 0),
                ':background' => value_or_default($color, ""),
                ':note' => "",
                ':date_created' => time()
            )
        );

        $background = $DB->query_single(
            'background',
            'nv_notes',
            'website = '.$website->id.'
             AND item_type = '.protect($item_type).'
             AND item_id = '.protect($item_id).'
             ORDER BY date_created DESC'
        );


        // TODO: purge old grid notes when current background is empty or transparent
        //          =>  remove all empty notes
        // NOT REALLY NEEDED, just save the item grid notes history, let the user remove at will

        if(empty($background) || $background=='transparent')
        {
            $DB->execute('
                DELETE FROM nv_notes
                WHERE website = '.$website->id.'
                  AND item_type = '.protect($item_type).' 
                  AND item_id = '.protect($item_id).'
                  AND note = ""
            ');
        }

    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.