    public function load_by_profile($network, $network_user_id)
    {
        global $DB;
        global $session;

        // the profile exists (connected to a social network)?
        $swuser = $DB->query_single(
            'webuser',
            'nv_webuser_profiles',
            ' network = '.protect($network).' AND '.
            ' network_user_id = '.protect($network_user_id)
        );

        if(!empty($swuser))
            $this->load($swuser);
    }

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.