	public function load($code)
	{
		global $DB;
        global $website;

        // retrieve extension definition from filesystem
        if(file_exists(NAVIGATE_PATH.'/plugins/'.$code.'/'.$code.'.plugin'))
            $this->definition = @json_decode(file_get_contents(NAVIGATE_PATH.'/plugins/'.$code.'/'.$code.'.plugin'));

        debug_json_error('extension: '.$code);

        $this->id = null;
        $this->website = $website->id;
        $this->title = $this->definition->title;
        $this->code = $code;
        $this->enabled = 1; // default
        $this->settings = array(); // default

        // now retrieve extension configuration for the active website
        $DB->query('
          SELECT * FROM nv_extensions
          WHERE website = '.protect($this->website).'
            AND extension = '.protect($this->code)
        );

        $row = $DB->first();

        if(!empty($row))
        {
            $this->id = $row->id;
            $this->enabled = $row->enabled;
            $this->settings = json_decode($row->settings, true);
        }
        else
        {
            // get from definition the default values for settings, if any
            if(isset($this->definition->options))
            {
                foreach ($this->definition->options as $option)
                {
                    if (isset($option->dvalue))
                    {
                        $this->settings[$option->id] = $option->dvalue;
                    }
                }
            }
        }
	}

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.