function dashboard_panel_top_pages($params)
{
    global $DB;
    global $website;

    $stats = &$params['statistics'];
    $navibars = &$params['navibars'];

    /* TOP PAGES */
    $sql = '
	    SELECT i.views as page_views, i.id as id_item, i.category as id_category, p.views as path_views, p.path as path
          FROM nv_items i, nv_paths p
         WHERE i.website = '.protect($website->id).'
           AND i.template > 0
           AND i.embedding = 0
           AND p.website = '.protect($website->id).'
           AND p.type = "item"
           AND p.object_id = i.id

        UNION ALL

        SELECT s.views as page_views, NULL as id_item, s.id as id_category, p.views as path_views, p.path as path
          FROM nv_structure s, nv_paths p
         WHERE s.website = '.protect($website->id).'
           AND p.website = '.protect($website->id).'
           AND p.type = "structure"
           AND p.object_id = s.id

        ORDER BY path_views DESC
        LIMIT 10
    ';

    $DB->query($sql, 'array');
    $pages = $DB->result();

    $pages_html = '';

    $url = $website->protocol;

    if(!empty($website->subdomain))
        $url .= $website->subdomain.'.';
    $url .= $website->domain;
    $url .= $website->folder;

    for($e = 0; $e < 10; $e++)
    {
        if(!$pages[$e]) break;

        $pages_html .= '<div class="navigate-panel-recent-comments-username ui-corner-all items-comment-status-public">'.
            '<a href="'.$url.$pages[$e]['path'].'" target="_blank">'.
            '<strong>'.$pages[$e]['path_views'].'</strong> <img align="absmiddle" src="img/icons/silk/bullet_star.png" align="absmiddle"> '.$pages[$e]['path'].
            '</a>'.
            '</div>';
    }

    $navibars->add_tab_content_panel(
        '<img src="img/icons/silk/award_star_gold_3.png" align="absmiddle" /> '.t(296, 'Top pages'),
        $pages_html,
        'navigate-panel-top-pages',
        '100%',
        '314px'
    );
}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.