CVE-2018-17552: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-10-03T20:29Z
Repository: https://github.com/NavigateCMS/Navigate-CMS
Language: PHP
Files changed: lib/core/core.php, lib/core/database.class.php, lib/core/language.class.php, lib/core/user.class.php, lib/layout/layout.class.php, lib/layout/navibars.class.php, lib/layout/naviforms.class.php, lib/packages/about/about.php, lib/packages/blocks/block.class.php, lib/packages/blocks/block_group.class.php, lib/packages/blocks/blocks.php, lib/packages/brands/brand.class.php, lib/packages/comments/comment.class.php, lib/packages/comments/comments.php, lib/packages/coupons/coupon.class.php, lib/packages/dashboard/dashboard.php, lib/packages/extensions/extension.class.php, lib/packages/extensions/extensions.php, lib/packages/feeds/feed.class.php, lib/packages/feeds/feeds.php, lib/packages/files/file.class.php, lib/packages/files/files.php, lib/packages/grid_notes/grid_notes.class.php, lib/packages/items/item.class.php, lib/packages/items/items.php, lib/packages/orders/order.class.php, lib/packages/orders/orders.php, lib/packages/paths/path.class.php, lib/packages/payment_methods/payment_method.class.php, lib/packages/permissions/permission.class.php, lib/packages/products/product.class.php, lib/packages/products/products.php, lib/packages/properties/property.class.php, lib/packages/properties/property.layout.php, lib/packages/shipping_methods/shipping_method.class.php, lib/packages/shipping_methods/shipping_methods.php, lib/packages/structure/structure.class.php, lib/packages/structure/structure.php, lib/packages/templates/template.class.php, lib/packages/templates/templates.php, lib/packages/themes/theme.class.php, lib/packages/themes/themes.php, lib/packages/users/users.php, lib/packages/users_log/users_log.class.php, lib/packages/webdictionary/webdictionary.class.php, lib/packages/webdictionary/webdictionary_history.class.php, lib/packages/websites/website.class.php, lib/packages/websites/websites.php, lib/packages/webuser_votes/webuser_vote.class.php, lib/packages/webusers/webuser.class.php, lib/packages/webusers/webuser_group.class.php, lib/webgets/blocks.php, lib/webgets/comments.php, lib/webgets/conditional.php, lib/webgets/contact.php, lib/webgets/content.php, lib/webgets/gallery.php, lib/webgets/list.php, lib/webgets/liveedit.php, lib/webgets/menu.php, lib/webgets/metatags.php, lib/webgets/product.php, lib/webgets/properties.php, lib/webgets/search.php, lib/webgets/tags.php, lib/webgets/votes.php, lib/webgets/webuser.php, login.php, web/nvweb_plugins.php, web/nvweb_routes.php, web/nvweb_templates.php, web/nvweb_xmlrpc.php
Commit date: 2018-09-24 10:29:24 +0200
Commit message: * security fix: replace string filtering by parameterization in almost all queries

Diff: diff --git a/lib/core/core.php b/lib/core/core.php
index 529f4702..d5ced5d3 100644
--- a/lib/core/core.php
+++ b/lib/core/core.php
@@ -182,19 +182,26 @@ function core_load_function($fid)
             $func->lid = '';
             $func->enabled = 1;
             break;
 
         default:
+            $query_params = NULL;
             if(is_numeric($fid))
+            {
                 $where = 'id = '.intval($fid);
+            }
             else
-                $where = 'codename = '.protect($fid);
+            {
+                $where = 'codename = :codename';
+                $query_params = array(':codename' => $fid);
+            }
 
-            $DB->query('SELECT *
-                          FROM nv_functions
-                         WHERE '.$where.'
-                           AND enabled = 1');
+            $DB->query(
+                'SELECT * FROM nv_functions WHERE '.$where.' AND enabled = 1',
+                'object',
+                $query_params
+            );
 
             $func = $DB->first();
 
             if(!$menu_layout->function_is_displayed($func->id))
                 $func = false;
@@ -1177,13 +1184,13 @@ function navigate_compose_email($data, $style=array())
         // default colors
         $background_color = '#E5F1FF';
         $title_color = '#595959';
         $text_color = '#595959';
 
-        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.background_color") . ' AND website = ' . protect($website->id), 'id DESC');
-        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.text_color") . ' AND website = ' . protect($website->id), 'id DESC');
-        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.titles_color") . ' AND website = ' . protect($website->id), 'id DESC');
+        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.background_color" AND website = ' . intval($website->id), 'id DESC');
+        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.text_color" AND website = ' . intval($website->id), 'id DESC');
+        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.titles_color" AND website = ' . intval($website->id), 'id DESC');
 
         if (!empty($background_color_db))
             $background_color = str_replace('"', '', $background_color_db);
 
         if (!empty($text_color_db))
diff --git a/lib/core/database.class.php b/lib/core/database.class.php
index 1adf9eb8..987ec4fa 100644
--- a/lib/core/database.class.php
+++ b/lib/core/database.class.php
@@ -90,14 +90,15 @@ class database
 	 *
 	 * Given a certain ID, function t returns the associated string
 	 * in the current active language.
 	 *
 	 * @param string $sql The complete SQL query
-	 * @param string $fetch_mode How to retrieve the data: "object" or "array" 
+	 * @param string $fetch_mode How to retrieve the data: "object" or "array"
+     * @param array $parameters SQL query parameters associative array
 	 * @return boolean True if the query was executed without errors
 	 */	
-	public function query($sql, $fetch_mode='object')
+	public function query($sql, $fetch_mode='object', $parameters=array())
 	{
 		$this->lastError = '';
 		$this->lastResult = '';
 
 		switch($fetch_mode)
@@ -112,11 +113,19 @@ class database
 				break;	
 		}
 
 		try
 		{
-			$statement = $this->db->query($sql);
+		    if(empty($parameters))
+            {
+			    $statement = $this->db->query($sql);
+            }
+            else
+            {
+                $statement = $this->db->prepare($sql);
+                $statement->execute($parameters);
+            }
 			$this->queries_count++;
 
 			// avoid firing a fatal error exception when the result is NULL
             // and the query is not malformed
 			if(!$statement)
@@ -144,21 +153,32 @@ class database
 	 *
 	 * @param string $column Name of the column to retrieve
 	 * @param string $table Table name to get the data from
 	 * @param string $where SQL conditions in the WHERE clause
 	 * @param string $order SQL order conditions in the ORDER BY clause
+     * @param array $parameters SQL query parameters associative array
 	 * @return string|integer Value of the first column of the first row of the resultset
 	 */		
-	public function query_single($column, $table, $where = '1=1', $order = '')
+	public function query_single($column, $table, $where = '1=1', $order = '', $parameters=array())
 	{
 	    $rs = null;
         if(!empty($order))
             $order = ' ORDER BY '.$order;
 
+        $sql = 'SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1';
+
         try
         {
-            $stm = $this->db->query('SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1');
+            if(empty($parameters))
+            {
+                $stm = $this->db->query($sql);
+            }
+            else
+            {
+                $stm = $this->db->prepare($sql);
+                $stm->execute($parameters);
+            }
             $this->queries_count++;
             $stm->setFetchMode(PDO::FETCH_NUM);
             $rs = $stm->fetchAll();
             $stm->closeCursor();
             unset($stm);
@@ -166,12 +186,18 @@ class database
         catch(Exception $e)
         {
             return NULL;
         }
 
-		if(empty($rs)) 	return NULL;
-		else			return $rs[0][0];
+		if(empty($rs))
+		{
+            return NULL;
+        }
+		else
+        {
+            return $rs[0][0];
+        }
 	}
 
 
 	/**
 	 * Send a SQL query to the database and get the resulset with an offset and a limit
@@ -182,11 +208,11 @@ class database
 	 * @param string $order SQL order clause
 	 * @param integer $offset The number of rows to skip of the resultset
 	 * @param integer $max How many rows will be returned of the resultset (after applying offset)
 	 * @return boolean True if the query could be executed without errors
 	 */	
-	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100)
+	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100, $parameters=array())
 	{		
 		$this->lastError = '';
 		$this->lastResult = '';	
 		$fetch = PDO::FETCH_ASSOC;
 
@@ -197,11 +223,20 @@ class database
 					  WHERE '.$where.'
  				   ORDER BY '.$order.' 
 					  LIMIT '.$max.'
 					 OFFSET '.$offset;
 
-			$statement = $this->db->query($sql);
+			if(empty($parameters))
+            {
+                $statement = $this->db->query($sql);
+            }
+            else
+            {
+                $statement = $this->db->prepare($sql);
+                $statement->execute($parameters);
+            }
+
             $this->queries_count++;
 			$statement->setFetchMode($fetch);
 			$this->lastResult = $statement->fetchAll();
 			$statement->closeCursor();
 			unset($statement);
diff --git a/lib/core/language.class.php b/lib/core/language.class.php
index 47d64f78..777b4a3a 100644
--- a/lib/core/language.class.php
+++ b/lib/core/language.class.php
@@ -16,11 +16,15 @@ class language
 	 */		
 	public function load($code='en')
 	{
 		global $DB;
 
-		$DB->query('SELECT * FROM nv_languages WHERE code = '.protect($code));
+		$DB->query(
+		    'SELECT * FROM nv_languages WHERE code = :code',
+            'object',
+            array(':code' => $code)
+        );
 		$data = $DB->first();
 
 		if(empty($data->id))
 		    return;
 
diff --git a/lib/core/user.class.php b/lib/core/user.class.php
index f6a6ea9f..dafa2ac9 100644
--- a/lib/core/user.class.php
+++ b/lib/core/user.class.php
@@ -49,14 +49,17 @@ class user
 
 		$user = trim($user);
 		$user = mb_strtolower($user);
 		
 		$A1 = md5($user.':'.APP_REALM.':'.$pass);	
-		
-		if($DB->query('SELECT * 
-						 FROM nv_users 
-						WHERE LOWER(username) = '.protect($user)))
+        $found = $DB->query(
+            'SELECT * FROM nv_users WHERE LOWER(username) = :username',
+            'object',
+            array(':username' => $user)
+        );
+
+		if(!empty($found))
 		{		
 			$data = $DB->result();	
 							
 			if($data[0]->password==$A1) 
 			{
@@ -334,13 +337,19 @@ class user
 
         $DB->query(
             'SELECT * 
              FROM nv_settings 
              WHERE  type = "user" AND 
-                    user = '.protect($this->id).' AND
-                    website = '.protect($website->id).' AND 
-                    name = '.protect($name)
+                    user = :user AND
+                    website = :website AND 
+                    name = :name',
+            'object',
+            array(
+                ':user' => $this->id,
+                ':website' => $website->id,
+                ':name' => $name
+            )
         );
 
         $setting = $DB->first();
 
         if(!isset($value))
diff --git a/lib/layout/layout.class.php b/lib/layout/layout.class.php
index 5c2edd6c..38655f7f 100644
--- a/lib/layout/layout.class.php
+++ b/lib/layout/layout.class.php
@@ -561,11 +561,17 @@ class layout
 
 		$fid = $_REQUEST['fid'];
 		if(empty($fid))
 			$fid = 'dashboard';
 
-		$user_profile_name = $DB->query_single('name', 'nv_profiles', 'id='.protect($user->profile));
+		$user_profile_name = $DB->query_single(
+		    'name',
+            'nv_profiles',
+            'id = :user_profile',
+            'NULL',
+            array(':user_profile' => $user->profile)
+        );
 
 		$this->add_content(
 			'<div class="navigate-help">'.
                 (empty($website->id)? '' : '<a class="navigate-plus-link" href="#" title="'.t(38, 'Create').'"><i class="fa fa-fw fa-plus"></i></span></a>').
 				//'<a class="navigate-favorites-link" href="#" title="'.t(465, 'Favorites').'"><i class="fa fa-fw fa-heart"></i></span></a>'.
@@ -751,10 +757,11 @@ class layout
                 77: "'.t(77, 'Properties').'",
                 82: "'.t(82, 'File').'",
                 92: "'.t(92, 'Close').'",
                 141: "'.t(141, 'Folder').'",
                 152: "'.t(152, 'Continue').'",
+                159: "'.t(159, 'Name').'",
                 170: "'.t(170, 'Edit').'",
                 171: "'.t(171, 'Order').'",
                 185: "'.t(185, 'Searching elements').'",
                 189: "'.t(189, 'Copy from').'",
                 190: "'.t(190, 'Ok').'",
diff --git a/lib/layout/navibars.class.php b/lib/layout/navibars.class.php
index 516cdff3..882cb783 100644
--- a/lib/layout/navibars.class.php
+++ b/lib/layout/navibars.class.php
@@ -31,11 +31,11 @@ class navibars
                     ($_REQUEST['fid']=='extensions' && $_REQUEST['act']=='run' && (empty($_REQUEST['mode']) || $_REQUEST['mode']=='list'))
                 )
 				{
                     // we are displaying a list
 					$actions[$search_form_pos][] = '<img onclick="$(this).next().triggerHandler(\'submit\');" height="16" align="absmiddle" width="16" src="img/icons/silk/zoom.png"></a>';
-					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false;">';
+					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" if(typeof(navitable_quicksearch)==\'function\') { navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false; } else return true;">';
 				}
 				else // other screen than a list
 				{
 					$actions[$search_form_pos][] = '<img onclick="$(this).next().trigger(\'submit\');" height="16" align="absmiddle" width="16" src="img/icons/silk/zoom.png"></a>';					
 					$actions[$search_form_pos][] = '<form method="GET" action="?">';
diff --git a/lib/layout/naviforms.class.php b/lib/layout/naviforms.class.php
index 7f053052..f7ef1546 100644
--- a/lib/layout/naviforms.class.php
+++ b/lib/layout/naviforms.class.php
@@ -261,10 +261,11 @@ class naviforms
                 var naviforms_autocomplete_'.$uid.' = [];
                 
                 $("a[data-action=create_custom_value][data-uid='.$uid.']").on("click", function()
                 {
                     var text = prompt(navigate_t(159, "Name"));
+                    if(!text) return;
                     text = text.trim();
                     if(text != "")
                     {
                         naviforms_autocomplete_'.$uid.'.unshift(text);
                         $("#'.$name.'").val(text);
diff --git a/lib/packages/about/about.php b/lib/packages/about/about.php
index 7071ce10..8b5ef64d 100644
--- a/lib/packages/about/about.php
+++ b/lib/packages/about/about.php
@@ -52,11 +52,11 @@ function about_layout()
 	$navibars->add_tab(t(218, 'Third party libraries'));	
 	
 	$navibars->add_tab_content_row(
 		array(
 			'<label>'.t(218, 'Third party libraries').'</label>',
-			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.0c</a><br />'
+			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.3</a><br />'
 		)
 	);
 
 	// note: the tinymce-codemirror plugin has Apache 2 License, but the author Arjan (from Webgear.nl) has given permission to use and include the code in this application
     $navibars->add_tab_content_row(
diff --git a/lib/packages/blocks/block.class.php b/lib/packages/blocks/block.class.php
index a654a7b4..7011dff8 100644
--- a/lib/packages/blocks/block.class.php
+++ b/lib/packages/blocks/block.class.php
@@ -608,12 +608,16 @@ class block
             {
                 $theme_blocks[$b]['title'] = $theme->t($theme_blocks[$b]['title']);
                 $theme_blocks[$b]['count'] = $DB->query_single(
                     'COUNT(*) AS total',
                     'nv_blocks',
-                    ' website = '.$website->id.' AND 
-                      type = '.protect($theme_blocks[$b]['id'])
+                    ' website = :wid AND type = :type',
+                    NULL,
+                     array(
+                        ':wid' => $website->id,
+                        ':type' => $theme_blocks[$b]['id']
+                     )
                 );
             }
         }
 
         if(!is_array($data))
@@ -669,15 +673,19 @@ class block
 
         $array = array_filter($array);
         sort($array);
 
 		$array = serialize($array);
-				
+
 		$ok = $DB->execute('
 		    UPDATE nv_websites
-               SET block_types = '.protect($array).'
-			 WHERE id = '.$website->id
+               SET block_types = :block_types
+			 WHERE id = :wid',
+            array(
+                ':wid' => $website->id,
+                ':block_types' => $array
+            )
         );
 					
 		if(!$ok)
 			throw new Exception($DB->last_error());
 							
@@ -937,11 +945,11 @@ class block
         global $website;
 
         $DB->query('
             SELECT *
             FROM nv_blocks
-            WHERE website = '.protect($website->id),
+            WHERE website = '.intval($website->id),
             'object'
         );
 
         $out = $DB->result();
 
diff --git a/lib/packages/blocks/block_group.class.php b/lib/packages/blocks/block_group.class.php
index f953d77f..6b0bac0b 100644
--- a/lib/packages/blocks/block_group.class.php
+++ b/lib/packages/blocks/block_group.class.php
@@ -25,13 +25,21 @@ class block_group
     public function load_by_code($code)
 	{
 		global $DB;
 		global $website;
 
-		if($DB->query('SELECT * FROM nv_block_groups
-						WHERE code = '.protect($code).'
-						  AND website = '.$website->id))
+        $found = $DB->query(
+            'SELECT * FROM nv_block_groups
+                  WHERE code = :code
+                    AND website = '.$website->id,
+            'object',
+            array(
+                ':code' => $code
+            )
+        );
+
+		if($found)
 		{
 			$data = $DB->result();
 			$this->load_from_resultset($data);
 		}
 	}
@@ -196,11 +204,11 @@ class block_group
 	    global $website;
 
         $DB->queryLimit(
             '*',
             'nv_block_groups',
-            'website = '.protect($website->id),
+            'website = '.intval($website->id),
             $order_by_field.' '.$order_by_ascdesc,
             $offset,
             $limit
         );
         $rs = $DB->result();
@@ -233,11 +241,11 @@ class block_group
         $out = array();
 
         $DB->query('
             SELECT *
               FROM nv_block_groups
-             WHERE website = '.protect($website->id),
+             WHERE website = '.intval($website->id),
             'object'
         );
         $out = $DB->result();
 
         if($type='json')
diff --git a/lib/packages/blocks/blocks.php b/lib/packages/blocks/blocks.php
index f724c27d..3f341106 100644
--- a/lib/packages/blocks/blocks.php
+++ b/lib/packages/blocks/blocks.php
@@ -272,17 +272,21 @@ function run()
             }
             break;
 
         case 'path':
 		case 5:	// search an existing path
-			$DB->query('SELECT path as id, path as label, path as value
+			$DB->query(
+			    'SELECT path as id, path as label, path as value
 						  FROM nv_paths
-						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').' 
+						 WHERE path LIKE :path 
 						   AND website = '.$website->id.'
 				      ORDER BY path ASC
 					     LIMIT 10',
-						'array');
+                'array',
+                array(
+                    ':path' => '%' . $_REQUEST['term'] . '%'
+                ));
 						
 			echo json_encode($DB->result());
 							  
 			core_terminate();		
 			break;
diff --git a/lib/packages/brands/brand.class.php b/lib/packages/brands/brand.class.php
index b6c5fe39..3f5b6c7d 100644
--- a/lib/packages/brands/brand.class.php
+++ b/lib/packages/brands/brand.class.php
@@ -132,11 +132,11 @@ class brand
     public function backup($type='json')
     {
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_brands WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_brands WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/comments/comment.class.php b/lib/packages/comments/comment.class.php
index fe0195c0..4c73976b 100644
--- a/lib/packages/comments/comment.class.php
+++ b/lib/packages/comments/comment.class.php
@@ -277,11 +277,11 @@ class comment
 
         $out = array();
 
         $DB->query('
 			SELECT * FROM nv_comments
-			 WHERE website = '.protect($website->id),
+			 WHERE website = '.intval($website->id),
 	        'object'
         );
         $out = $DB->result();
 
         if($type='json')
@@ -296,11 +296,11 @@ class comment
         global $website;
 
         $pending_comments = $DB->query_single(
             'COUNT(*)',
             'nv_comments',
-            ' website = '.protect($website->id).' AND
+            ' website = '.intval($website->id).' AND
               status = -1'
         );
 
         return $pending_comments;
     }
@@ -311,16 +311,16 @@ class comment
         global $website;
 
         $count = $DB->query_single(
 	        'count(*) as total',
 	        'nv_comments',
-	        'website = '.protect($website->id).' AND status = 3'
+	        'website = '.intval($website->id).' AND status = 3'
         );
 
         $ok = $DB->execute('
 			DELETE FROM nv_comments
-             WHERE website = '.protect($website->id).'
+             WHERE website = '.intval($website->id).'
                AND status = 3
         ');
 
         if($ok)
             return $count;
@@ -519,15 +519,20 @@ class comment
 
             // find users subscribed to the same content (except the author of the current comment)
             $DB->query('
                 SELECT id, user, email 
                  FROM nv_comments
-                WHERE website = ' . $this->website . '
-                  AND object_type = ' . protect($this->object_type) . '
-                  AND object_id = ' . protect($this->object_id) . '
-                  AND subscribed = 1
-            ');
+                WHERE website = :wid
+                  AND object_type = :otype
+                  AND object_id = :oid
+                  AND subscribed = 1',
+                'object',
+                array(
+                    ':wid' => $this->website,
+                    ':otype' => $this->object_type,
+                    ':oid' => $this->object_id
+                ));
 
             $subscribers = $DB->result();
 
             $emailed_to = array();
             $users_emailed_to = array();
@@ -704,12 +709,12 @@ class comment
         global $website;
 
         $DB->query('  
             SELECT COUNT(*) AS total 
             FROM nv_comments 
-            WHERE website = '.protect($website->id).' 
-            AND user = '.protect($webuser_id).'
+            WHERE website = '.intval($website->id).' 
+            AND user = '.intval($webuser_id).'
             AND status = 0'
         );
 
         $out = $DB->result('total');
         if(is_array($out))
diff --git a/lib/packages/comments/comments.php b/lib/packages/comments/comments.php
index 3558bd6e..9f565d23 100644
--- a/lib/packages/comments/comments.php
+++ b/lib/packages/comments/comments.php
@@ -175,42 +175,58 @@ function run()
             $out = comments_list();
 			users_log::action($_REQUEST['fid'], $website->id, 'remove_spam', "", json_encode($_REQUEST));
             break;
 
         case 'json_find_webuser': // json find webuser by name (for "user" autocomplete)
-            $DB->query('SELECT id, username as text
-						  FROM nv_webusers
-						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
-						 AND website = '.$website->id.'
-				      ORDER BY username ASC
-					     LIMIT 30',
-                'array');
+            $DB->query(
+                'SELECT id, username as text
+                      FROM nv_webusers
+                     WHERE username LIKE :username
+                     AND website = :wid
+                  ORDER BY username ASC
+                     LIMIT 30',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':username' => '%' . $_REQUEST['username'] . '%'
+                )
+            );
 
             $rows = $DB->result();
             $total = $DB->foundRows();
             echo json_encode(array('items' => $rows, 'totalCount' => $total));
 
             core_terminate();
             break;
 
         case 'json_find_comment': // json find comment by text search (for "in reply to" autocomplete)
-            $DB->query('SELECT c.id, c.date_created, c.name, u.username, c.message
-						  FROM nv_comments c
-						  LEFT JOIN nv_webusers u ON c.user = u.id
-						 WHERE
-						    c.website = '.$website->id.' AND
-						    c.object_type = '.protect($_REQUEST['object_type']).' AND
-						    c.object_id = '.protect($_REQUEST['object_id']).' AND
-						    c.date_created <= '.$_REQUEST['maxdate'].' AND
-						    c.id <> '.$_REQUEST['exclude'].' AND						     
-						    (   c.name LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
-						        c.message LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
-						        u.username LIKE ' . protect('%' . $_REQUEST['search'] . '%') . '
-                            )                          
-				      ORDER BY c.date_created DESC
-					     LIMIT 30',
-                'array');
+            $DB->query(
+                'SELECT c.id, c.date_created, c.name, u.username, c.message
+                      FROM nv_comments c
+                      LEFT JOIN nv_webusers u ON c.user = u.id
+                     WHERE
+                        c.website = :wid AND
+                        c.object_type = :object_type AND
+                        c.object_id = :object_id AND
+                        c.date_created <= :maxdate AND
+                        c.id <> :exclude AND						     
+                        (   c.name LIKE :text OR
+                            c.message LIKE :text OR
+                            u.username LIKE :text
+                        )                          
+                  ORDER BY c.date_created DESC
+                     LIMIT 30',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':object_type' => $_REQUEST['object_type'],
+                    ':object_id' => $_REQUEST['object_id'],
+                    ':date_created' => $_REQUEST['maxdate'],
+                    ':exclude' => $_REQUEST['exclude'],
+                    ':text' => '%' . $_REQUEST['search'] . '%'
+                )
+            );
 
             $rows = $DB->result();
             $total = $DB->foundRows();
 
             for($r=0; $r < count($rows); $r++)
@@ -220,35 +236,43 @@ function run()
 
             core_terminate();
             break;
 
         case 'json_get_comment': // json get comment by ID
-            $DB->query('SELECT c.*
-						  FROM nv_comments c
-						  LEFT JOIN nv_webusers u ON c.user = u.id
-						 WHERE
-						    c.website = '.$website->id.' AND
-						    c.id = '.protect($_REQUEST['id']));
+            $DB->query(
+                'SELECT c.*
+                      FROM nv_comments c
+                      LEFT JOIN nv_webusers u ON c.user = u.id
+                     WHERE
+                        c.website = '.$website->id.' AND
+                        c.id = '.intval($_REQUEST['id'])
+            );
 
             $comment = $DB->first();
 
             echo json_encode($comment);
 
             core_terminate();
             break;
 
         case "find_object_titles":
             // json search title request (for "item" autocomplete)
-			$DB->query('SELECT DISTINCT node_id as id, text as label, text as value
-						  FROM nv_webdictionary
-						 WHERE node_type = '.protect($_REQUEST['object_type']).'
-						   AND subtype = "title"
-						   AND website = '.$website->id.' 
-						   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
-				      ORDER BY text ASC
-					     LIMIT 30',
-						'array'
+			$DB->query(
+			    'SELECT DISTINCT node_id as id, text as label, text as value
+                      FROM nv_webdictionary
+                      WHERE node_type = :object_type
+                       AND subtype = "title"
+                       AND website = :wid 
+                       AND text LIKE :text
+                      ORDER BY text ASC
+                      LIMIT 30',
+                    'array',
+                    array(
+                        ':object_type' => $_REQUEST['object_type'],
+                        ':wid' => $website->id,
+                        ':text' => '%'.$_REQUEST['title'].'%'
+                    )
                     // AND lang = '.protect($_REQUEST['lang']).'
             );
 						
 			echo json_encode($DB->result());
 			session_write_close();
diff --git a/lib/packages/coupons/coupon.class.php b/lib/packages/coupons/coupon.class.php
index c5afb533..548c472a 100644
--- a/lib/packages/coupons/coupon.class.php
+++ b/lib/packages/coupons/coupon.class.php
@@ -209,11 +209,11 @@ class coupon
     public function backup($type='json')
     {
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_coupons WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_coupons WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
@@ -254,13 +254,13 @@ class coupon
         {
             $times_used_by_customer = $DB->query_single(
                 'COUNT(*)',
                 'nv_orders',
                 ' 
-                    website = '.protect($website->id).' AND
-                    webuser = '.protect($webuser).' AND 
-                    coupon = '.protect($this->id)
+                    website = '.intval($website->id).' AND
+                    webuser = '.intval($webuser).' AND 
+                    coupon = '.intval($this->id)
             );
 
             if($times_used_by_customer > $this->times_allowed_customer)
                 $redeemable = false;
         }
@@ -270,12 +270,12 @@ class coupon
         {
             $times_used_globally = $DB->query_single(
                 'COUNT(*)',
                 'nv_orders',
                 ' 
-                    website = '.protect($website->id).' AND
-                    coupon = '.protect($this->id)
+                    website = '.intval($website->id).' AND
+                    coupon = '.intval($this->id)
             );
 
             if($times_used_globally > $this->times_allowed_globally)
                 $redeemable = false;
         }
@@ -289,13 +289,17 @@ class coupon
         global $website;
 
         $DB->query('
             SELECT * 
             FROM nv_coupons 
-            WHERE website = '.protect($website->id).' AND
-                  code = '.protect($code),
-            'object'
+            WHERE website = :wid AND
+                  code = :code',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':code' => $code
+            )
         );
 
         $rs = $DB->result();
         $out = false;
 
diff --git a/lib/packages/dashboard/dashboard.php b/lib/packages/dashboard/dashboard.php
index 1d6e8589..a62ba0c0 100644
--- a/lib/packages/dashboard/dashboard.php
+++ b/lib/packages/dashboard/dashboard.php
@@ -256,59 +256,59 @@ function dashboard_panel_web_summary($params)
     global $layout;
 
     $stats = &$params['statistics'];
     $navibars = &$params['navibars'];
 
-//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.protect($website->id).' GROUP BY object_id');
+//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.intval($website->id).' GROUP BY object_id');
 
     // count number of paths, ignoring extra languages (so if the item has 3 languages and 3 different paths, only one is counted)
     $DB->query('
 	    SELECT COUNT(c.object_id) as total
 	      FROM
 	      (
                 SELECT DISTINCT p.object_id
                   FROM nv_paths p
-                 WHERE p.website = '.protect($website->id).'
+                 WHERE p.website = '.intval($website->id).'
               GROUP BY p.object_id
           ) c
     ');
     $count = $DB->first();
     $stats['pages_available'] = $count->total;
 
     // we need to include elements without paths assigned but accessible through /node/xx
     $DB->query('
         SELECT COUNT(i.id) as total
           FROM nv_items i
-         WHERE i.website = '.protect($website->id).'
+         WHERE i.website = '.intval($website->id).'
            AND i.embedding = 0
            AND (
                 SELECT count(p.id)
                  FROM nv_paths p
                 WHERE p.object_id = i.id
            ) < 1
     ');
     $count = $DB->first();
     $stats['pages_available'] += $count->total;
 
-//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.protect($website->id));
-    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id));
-    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id).' AND status = -1');
+//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.intval($website->id));
+    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id));
+    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id).' AND status = -1');
 
     $DB->query('
 		SELECT SUM(x.page_views) as pages_viewed FROM
 		(	
 			SELECT i.views as page_views, i.id as id_item 
 			  FROM nv_items i
-			 WHERE i.website = '.protect($website->id).'
+			 WHERE i.website = '.intval($website->id).'
 			   AND i.template > 0
 			   AND i.embedding = 0
 
 			UNION ALL
 
 			SELECT s.views as page_views, s.id as id_category
 			  FROM nv_structure s
-			 WHERE s.website = '.protect($website->id).'
+			 WHERE s.website = '.intval($website->id).'
 		) x
 	');
 
     // i.embedding = 0  : all free items and category items not shown in the first page of a category (p.e. news item)
     // union all main category pages
@@ -349,23 +349,23 @@ function dashboard_panel_top_pages($params)
 
     /* TOP PAGES */
     $sql = '
 	    SELECT i.views as page_views, i.id as id_item, i.category as id_category, p.views as path_views, p.path as path
           FROM nv_items i, nv_paths p
-         WHERE i.website = '.protect($website->id).'
+         WHERE i.website = '.intval($website->id).'
            AND i.template > 0
            AND i.embedding = 0
-           AND p.website = '.protect($website->id).'
+           AND p.website = '.intval($website->id).'
            AND p.type = "item"
            AND p.object_id = i.id
 
         UNION ALL
 
         SELECT s.views as page_views, NULL as id_item, s.id as id_category, p.views as path_views, p.path as path
           FROM nv_structure s, nv_paths p
-         WHERE s.website = '.protect($website->id).'
-           AND p.website = '.protect($website->id).'
+         WHERE s.website = '.intval($website->id).'
+           AND p.website = '.intval($website->id).'
            AND p.type = "structure"
            AND p.object_id = s.id
 
         ORDER BY path_views DESC
         LIMIT 10
@@ -423,18 +423,23 @@ function dashboard_panel_recent_comments($params)
         LEFT OUTER JOIN nv_webdictionary nvwd
               ON nvwd.node_id = nvc.object_id AND
                  nvwd.website = nvc.website AND
                  nvwd.node_type = nvc.object_type AND
                  nvwd.subtype = "title" AND
-                 nvwd.lang = '.protect($website->languages_published[0]).'
-      WHERE nvc.website = '.$website->id.'
-	  ORDER BY nvc.date_created DESC LIMIT '.$comments_limit
+                 nvwd.lang = :lang
+      WHERE nvc.website = :wid
+	  ORDER BY nvc.date_created DESC LIMIT '.intval($comments_limit),
+        'object',
+        array(
+            ':wid' => $website->id,
+            ':lang' => $website->languages_published[0]
+        )
     );
     // removed
     /*
         .. AND nvwu.website = nvc.website
-        .. WHERE nvc.website = '.protect($website->id).'
+        .. WHERE nvc.website = '.intval($website->id).'
 
         to allow cross-website members
     */
 
     $comments = $DB->result();
@@ -771,15 +776,16 @@ function dashboard_panel_public_wall($params)
     $stats = &$params['statistics'];
     $navibars = &$params['navibars'];
 
     $layout->navigate_notes_dialog('website', $website->id);
     $public_wall_notes = grid_notes::comments('website', $website->id);
+
     $elements_html = '
         <div class="navigate-panel-model-row hidden">
             <div class="navigate-panel-recent-comments-username ui-corner-all items-comment-status-public hide">
-                <span data-field="date"></span> 
-                <span data-field="username"><strong>'.$public_wall_notes[$e]['username'].'</strong></span>
+                <span data-field="date">date</span> 
+                <span data-field="username"><strong>username</strong></span>
             </div>
             <div data-field="note" class="navigate-panel-recent-comments-element"></div>
         </div>
     ';
     for($e = 0; $e < 4; $e++)
diff --git a/lib/packages/extensions/extension.class.php b/lib/packages/extensions/extension.class.php
index 51048623..baa1867f 100644
--- a/lib/packages/extensions/extension.class.php
+++ b/lib/packages/extensions/extension.class.php
@@ -32,13 +32,18 @@ class extension
         $this->enabled = 1; // default
         $this->settings = array(); // default
 
         // now retrieve extension configuration for the active website
         $DB->query('
-          SELECT * FROM nv_extensions
-          WHERE website = '.protect($this->website).'
-            AND extension = '.protect($this->code)
+            SELECT * FROM nv_extensions
+            WHERE website = :wid
+              AND extension = :code',
+            'object',
+            array(
+                ':wid' => $this->website,
+                ':code' => $this->code
+            )
         );
 
         $row = $DB->first();
 
         if(!empty($row))
@@ -190,11 +195,11 @@ class extension
         {
             core_remove_folder(NAVIGATE_PATH.'/plugins/'.$this->code);
 
             $ok = $DB->execute('
                 DELETE FROM nv_extensions
-                 WHERE id = '.protect($this->id)
+                 WHERE id = '.intval($this->id)
             );
 
             if(method_exists($events, 'trigger'))
             {
                 $events->trigger(
@@ -263,12 +268,17 @@ class extension
                 $DB->query('
                   SELECT subtype, lang, text
                     FROM nv_webdictionary
                    WHERE website = '.$website->id.'
                      AND node_type = "extension"
-                     AND lang = '.protect($current_language).'
-                     AND extension = '.protect($this->code)
+                     AND lang = :lang
+                     AND extension = :code',
+                    'object',
+                    array(
+                        ':lang' => $current_language,
+                        ':code' => $this->code
+                    )
                 );
                 $rs = $DB->result();
 
                 for($r=0; $r < count($rs); $r++)
                     $this->dictionary[$rs[$r]->subtype] = $rs[$r]->text;
@@ -342,11 +352,11 @@ class extension
         $enabled = array();
 
         $DB->query('
             SELECT extension, enabled
               FROM nv_extensions
-             WHERE website = '.protect($website->id),
+             WHERE website = '.intval($website->id),
             'array'
         );
 
         $rs = $DB->result();
 
diff --git a/lib/packages/extensions/extensions.php b/lib/packages/extensions/extensions.php
index dbe3c1be..a8b71054 100644
--- a/lib/packages/extensions/extensions.php
+++ b/lib/packages/extensions/extensions.php
@@ -277,11 +277,11 @@ function extensions_grid($list)
 
         $extensions = array();
 
         for($i=0; $i < count($list); $i++)
         {
-            $extension_has_options = empty($list[$i]['options']);
+            $extension_has_options = !empty($list[$i]['options']);
             // ignore options for extensions of type payment_method
             if($list[$i]['type']=='payment_method')
                 $extension_has_options = false;
 
             $extensions[] = array(
@@ -479,13 +479,21 @@ function extensions_options($extension, $saved=null)
 
     $navibars->title(t(327, 'Extensions'));
 
     $layout->navigate_media_browser();	// we can use media browser in this function
 
-    $navibars->add_actions(		array(	'<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'	));
-
-    $navibars->add_actions(	array(	'<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'	)    );
+    $navibars->add_actions(
+        array(
+            '<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'
+        )
+    );
+
+    $navibars->add_actions(
+        array(
+            '<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'
+        )
+    );
 
     $navibars->form();
 
     $navibars->add_tab(t(7, 'Configuration'));
 
diff --git a/lib/packages/feeds/feed.class.php b/lib/packages/feeds/feed.class.php
index be0c31dd..7a975976 100644
--- a/lib/packages/feeds/feed.class.php
+++ b/lib/packages/feeds/feed.class.php
@@ -315,14 +315,19 @@ class feed
                            AND (i.access = 0)
                            AND d.website = i.website
                            AND d.node_type = "item"
                            AND d.subtype = "title"
                            AND d.node_id = i.id
-                           AND d.lang = '.protect($current['lang']).'
+                           AND d.lang = :lang
                          ORDER BY pdate DESC
                          LIMIT '.$limit.'
-                        OFFSET 0');
+                        OFFSET 0',
+                'object',
+                array(
+                    ':lang' => $current['lang']
+                )
+            );
 								
 			$rs = $DB->result();
 			
 			for($x=0; $x < count($rs); $x++)
 			{
@@ -449,11 +454,11 @@ class feed
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_feeds WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_feeds WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/feeds/feeds.php b/lib/packages/feeds/feeds.php
index a422d26c..d11a37e5 100644
--- a/lib/packages/feeds/feeds.php
+++ b/lib/packages/feeds/feeds.php
@@ -141,17 +141,21 @@ function run()
 				}
 			}
 			break;
 			
 		case "path_check": // check if a requested path is not used
-			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
-			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+			$DB->query(
+			    'SELECT type, object_id, lang
+                      FROM nv_paths
+                     WHERE path = :path
+                       AND website = :wid',
+                'object',
+                array(
+                    ':wid' => $this->website,
+                    'path' => $_REQUEST['path']
+                )
+            );
 						 
 			$rs = $DB->result();
 			
 			echo json_encode($rs);
 			core_terminate();		
diff --git a/lib/packages/files/file.class.php b/lib/packages/files/file.class.php
index 8bfe1368..2cd77b62 100644
--- a/lib/packages/files/file.class.php
+++ b/lib/packages/files/file.class.php
@@ -571,40 +571,64 @@ class file
 		global $website;
 
 		if(empty($wid))
 			$wid = $website->id;
 
-		$DB->query('  SELECT * FROM nv_files
-					   WHERE name LIKE '.protect('%'.$text.'%').'
-					     AND website = '.$wid.'
-					ORDER BY '.$orderby);
+		$DB->query(
+		    'SELECT * FROM nv_files
+			  	   WHERE name LIKE :text
+				     AND website = :wid
+				ORDER BY '.$orderby,
+            'object',
+            array(
+                ':wid' => $wid,
+                ':text' => '%' . $text . '%'
+            )
+        );
 					
 		return $DB->result();		
 	}
 	
 	public static function filesByMedia($media, $offset=0, $limit=-1, $wid=NULL, $text="", $orderby="date_added DESC, name ASC")
 	{
 		global $DB;
 		global $website;
 		
 		if(empty($wid))
-			$wid = $website->id;		
+        {
+			$wid = $website->id;
+        }
 
 		if($limit < 1)
+        {
 			$limit = 2147483647;
+        }
+
+        $query_params = array(
+            ':wid' => $wid,
+            ':type' => $media,
+        );
 
+		$text_search = "";
         if(!empty($text))
-            $text = ' AND name LIKE '.protect('%'.$text.'%');
+        {
+            $text_search = ' AND name LIKE :text';
+            $query_params[':text'] = '%' . $text . '%';
+        }
 		
-		$DB->query('  SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
-					   WHERE type = '.protect($media).'
-					     AND enabled = 1
-						 AND website = '.$wid.'
-						 '.$text.'
-					ORDER BY '.$orderby.'
-					   LIMIT '.$limit.' 
-					  OFFSET '.$offset);
+		$DB->query(
+		    'SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
+			  WHERE type = :type
+                 AND enabled = 1
+                 AND website = :wid 
+                 '.$text_search.'
+            ORDER BY '.$orderby.'
+               LIMIT '.$limit.' 
+              OFFSET '.$offset,
+            'object',
+            $query_params
+        );
 
         $total = $DB->foundRows();
         $rows = $DB->result();
 
 		return array($rows, $total);
@@ -2424,11 +2448,11 @@ class file
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_files WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_files WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/files/files.php b/lib/packages/files/files.php
index f2737357..7fe11137 100644
--- a/lib/packages/files/files.php
+++ b/lib/packages/files/files.php
@@ -418,11 +418,11 @@ function files_browser($parent, $search="")
 	$navibrowse->onRightClick('navigate_files_contextmenu');
 	$navibrowse->onMove('navigate_files_move');
     $navibrowse_hierarchy = $navibrowse->generate();
 	$navibars->add_content($navibrowse_hierarchy);
     
-    $layout->add_script('
+    $layout->add_script('    
         navigate_file_drop(
             ".navibrowse",
             "'.$parent.'",
             {
                 afterAll: function()
diff --git a/lib/packages/grid_notes/grid_notes.class.php b/lib/packages/grid_notes/grid_notes.class.php
index 4766a14c..9133d649 100644
--- a/lib/packages/grid_notes/grid_notes.class.php
+++ b/lib/packages/grid_notes/grid_notes.class.php
@@ -34,13 +34,18 @@ class grid_notes
 
         $background = $DB->query_single(
             'background',
             'nv_notes',
             'website = '.$website->id.'
-             AND item_type = '.protect($item_type).'
-             AND item_id = '.protect($item_id).'
-             ORDER BY date_created DESC'
+             AND item_type = :item_type
+             AND item_id = :item_id
+             ORDER BY date_created DESC',
+            NULL,
+            array(
+                ':item_type' => $item_type,
+                ':item_id' => $item_id
+            )
         );
 
 
         // TODO: purge old grid notes when current background is empty or transparent
         //          =>  remove all empty notes
@@ -49,14 +54,18 @@ class grid_notes
         if(empty($background) || $background=='transparent')
         {
             $DB->execute('
                 DELETE FROM nv_notes
                 WHERE website = '.$website->id.'
-                  AND item_type = '.protect($item_type).' 
-                  AND item_id = '.protect($item_id).'
-                  AND note = ""
-            ');
+                  AND item_type = :item_type 
+                  AND item_id = :item_id
+                  AND note = ""',
+                array(
+                    ':item_type' => $item_type,
+                    ':item_id' => $item_id
+                )
+            );
         }
 
     }
 
     public static function summary($dataset, $type, $field_id)
@@ -75,15 +84,21 @@ class grid_notes
         if(!empty($ids))
         {
             $DB->query(
                 'SELECT gn.id, gn.item_id, gn.background, gn.note, gn.date_created, u.username as creator
                    FROM nv_notes gn, nv_users u
-                  WHERE gn.website = '.protect($website->id).'
-                    AND gn.item_type = '.protect($type).'
-                    AND gn.item_id IN ('.implode(",", $ids).')
+                  WHERE gn.website = :wid
+                    AND gn.item_type = :item_type
+                    AND gn.item_id IN (:item_ids)
                     AND u.id = gn.user
-                  ORDER BY gn.item_id ASC, gn.date_created DESC'
+                  ORDER BY gn.item_id ASC, gn.date_created DESC',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':item_type' => $type,
+                    ':item_ids' => implode(",", $ids)
+                )
             );
 
             $grid_notes = $DB->result();
         }
 
@@ -132,16 +147,21 @@ class grid_notes
             $extra = ' AND gn.note != "" ';
 
         $DB->query("    
             SELECT gn.*, u.username as username
             FROM nv_notes gn, nv_users u
-            WHERE gn.website = ".protect($website->id)."
-              AND gn.item_type = ".protect($item_type)."
-              AND gn.item_id = ".protect($id)."
-              AND gn.user = u.id ".
-              $extra."
-            ORDER BY gn.date_created DESC"
+            WHERE gn.website = ".intval($website->id)."
+              AND gn.item_type = :item_type
+              AND gn.item_id = :item_id
+              AND gn.user = u.id 
+              ".$extra."
+            ORDER BY gn.date_created DESC",
+            'object',
+            array(
+                ':item_type' => $item_type,
+                ':item_id' => $id
+            )
         );
 
         $result = $DB->result();
 
         // transform result fields to human readable form
@@ -198,12 +218,12 @@ class grid_notes
         if(empty($id))
             return 'invalid_id';
 
         $DB->execute('
             DELETE FROM nv_notes
-                WHERE website = '.protect($website->id).'
-                  AND id = '.protect($id).'
+                WHERE website = '.intval($website->id).'
+                  AND id = '.intval($id).'
                 LIMIT 1'
         );
 
         return 'true';
     }
@@ -213,14 +233,19 @@ class grid_notes
         global $DB;
         global $website;
 
         $DB->execute('
             DELETE FROM nv_notes
-                WHERE website = '.protect($website->id).'
-                  AND item_type = '.protect($object_type).'
-                  AND item_id = '.protect($object_id).'
-                LIMIT 1'
+                WHERE website = :wid
+                  AND item_type = :object_type
+                  AND item_id = :object_id
+                LIMIT 1',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         return 'true';
     }
 
@@ -231,11 +256,11 @@ class grid_notes
 
         $out = array();
 
         $DB->query('
             SELECT * FROM nv_notes 
-            WHERE website = '.protect($website->id),
+            WHERE website = '.intval($website->id),
             'object'
         );
         $out = $DB->result();
 
         if($type='json')
diff --git a/lib/packages/items/item.class.php b/lib/packages/items/item.class.php
index 1d04c1c3..d16fa7c7 100644
--- a/lib/packages/items/item.class.php
+++ b/lib/packages/items/item.class.php
@@ -518,11 +518,11 @@ class item
 		else
 		{
 			$category_template = $DB->query_single(
                 'template',
                 'nv_structure',
-                ' id = '.protect($this->category).' AND website = '.$website->id
+                ' id = '.intval($this->category).' AND website = '.intval($website->id)
             );
 			$template->load($category_template);
 		}
 		
 		return $template;
@@ -640,13 +640,13 @@ class item
         if(empty($this->_comments_count))
         {
             $DB->query('
                 SELECT COUNT(*) as total
                       FROM nv_comments
-                     WHERE website = ' . protect($this->website) . '
+                     WHERE website = ' . intval($this->website) . '
                        AND object_type = "item"
-                       AND object_id = ' . protect($this->id) . '
+                       AND object_id = ' . intval($this->id) . '
                        AND status = 0'
             );
 
             $out = $DB->result('total');
             $this->_comments_count = $out[0];
@@ -777,11 +777,11 @@ class item
     {
         global $DB;
         global $website;
 
         $out = array();
-        $DB->query('SELECT * FROM nv_items WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_items WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/items/items.php b/lib/packages/items/items.php
index 29595df9..6252a01d 100644
--- a/lib/packages/items/items.php
+++ b/lib/packages/items/items.php
@@ -35,32 +35,35 @@ function run()
 					}
 					echo json_encode(true);
 					break;
 
                 case 'elements_by_tag':
-                    $tag = $_REQUEST['tag'];
-                    $lang = $_REQUEST['lang'];
-
                     $DB->query('
                         SELECT i.id, i.access, i.date_created AS date, d.text as title                               
                                FROM nv_items i
                           LEFT JOIN nv_webdictionary d
                                      ON i.id = d.node_id
                                     AND d.node_type = "item"
                                     AND d.subtype = "title"
-                                    AND d.lang = '.protect($lang).'
-                                    AND d.website = '.$website->id.'
+                                    AND d.lang = :lang
+                                    AND d.website = :wid
                             WHERE i.id IN (
                                 SELECT node_id FROM nv_webdictionary
-                                 WHERE website = ' . $website->id . '
+                                 WHERE website = :wid
                                    AND node_type = "item"
                                    AND subtype = "tags"
-                                   AND lang = ' . protect($lang) . '
-                                   AND FIND_IN_SET('.protect($tag).', text) > 0
+                                   AND lang = :lang
+                                   AND FIND_IN_SET(:tag, text) > 0
                             )
-                        ORDER BY i.id DESC
-                    ');
+                        ORDER BY i.id DESC',
+                        'object',
+                        array(
+                            ':lang' => $_REQUEST['lang'],
+                            ':wid' => $website->id,
+                            ':tag' => $_REQUEST['tag']
+                        )
+                    );
 
                     $rs = $DB->result();
 
                     for($r=0; $r < count($rs); $r++)
                         $rs[$r]->date = core_ts2date($rs[$r]->date);
@@ -223,11 +226,11 @@ function run()
                                 $dataset[$i]['category_path'] = $category_path;
                         }
 
                         $category_text = '';
                         if($dataset[$i]['association']=='free')
-                            $category_text = '[ '.strtolower(t(100, 'Free')).' ]';
+                            $category_text = '[ '.mb_strtolower(t(100, 'Free')).' ]';
                         else
                             $category_text = $dataset[$i]['category_path'];
 
 						$item_views = $dataset[$i]['views'];
 						if($item_views > 1000)
@@ -463,19 +466,27 @@ function run()
 
 			core_terminate();
 			break;
 			
 		case 90:
-			$DB->query('SELECT id, date_created, autosave
-						  FROM nv_webdictionary_history
-						 WHERE node_type = "item"
-						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-						   AND lang = '.protect($_GET['lang']).'
-						   AND node_id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id.' 
-				      ORDER BY date_created DESC',
-						'array');		
+			$DB->query(
+			    'SELECT id, date_created, autosave
+                      FROM nv_webdictionary_history
+                     WHERE node_type = "item"
+                       AND subtype = :subtype
+                       AND lang = :lang 
+                       AND node_id = :node_id
+                       AND website = :wid 
+                  ORDER BY date_created DESC',
+                    'array',
+                array(
+                    ':wid' => $website->id,
+                    ':node_id' => $_REQUEST['id'],
+                    ':lang' => $_REQUEST['lang'],
+                    ':subtype' => 'section-'.$_REQUEST['section']
+                )
+            );
 			
 			$result = $DB->result();
 			
 			if(!is_array($result)) $result = array();
 			for($i=0; $i < count($result); $i++)
@@ -495,16 +506,21 @@ function run()
 			$DB->query('
 				SELECT node_id as id, text as label, text as value
 				  FROM nv_webdictionary
 				 WHERE node_type = "item"
 				   AND subtype = "title"
-				   AND lang = '.protect($_REQUEST['lang']).'
-				   AND website = '.$website->id.'
-				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+				   AND lang = :lang
+				   AND website = :wid
+				   AND text LIKE :text
 		      ORDER BY text ASC
 			     LIMIT 20',
-				'array'
+				'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%'.$_REQUEST['title'].'%'
+                )
 			);
 
 			echo json_encode($DB->result());
 
 			core_terminate();
@@ -518,57 +534,75 @@ function run()
 			if($_REQUEST['history']=='true')
 			{
 				$DB->query('SELECT text
 							  FROM nv_webdictionary_history
 							 WHERE node_type = "item"
-							   AND website = '.$website->id.' 
-							   AND id = '.protect($_REQUEST['id']),							   
+							   AND website = '.intval($website->id).' 
+							   AND id = '.intval($_REQUEST['id']),
 							'array');	
 							
 				$data = $DB->first();				
 				echo $data['text'];		
 			}
 			else if($_REQUEST['zone'] == 'section')
 			{		
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "item"
-							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.' 
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "item"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':node_id' => $_REQUEST['node_id'],
+                        ':subtype' => 'section-'.$_REQUEST['section']
+                    )
+                );
 
 				$data = $DB->first();				
 				echo $data['text'];
 			}
 			else if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-item"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
-
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "property-item"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                        'array',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $_REQUEST['lang'],
+                            ':node_id' => $_REQUEST['node_id'],
+                            ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']
+                        )
+                    );
+                
 				$data = $DB->first();
 				echo $data['text'];
 			}
 							  
 			core_terminate();
 			break;
 
 		// return raw template content
 		case 93:
-			$DB->query('SELECT file
-						  FROM nv_templates
-						 WHERE enabled = 1
-						   AND id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id,
-						'array');
+			$DB->query(
+			    'SELECT file
+                    FROM nv_templates
+                   WHERE enabled = 1
+                     AND id = '.intval($_REQUEST['id']).'
+                     AND website = '.intval($website->id),
+                'array'
+            );
 						
 			$data = $DB->first();
 			
 			echo @file_get_contents(NAVIGATE_PRIVATE.'/'.$website->id.'/templates/'.$data['file']);
 							  
@@ -624,16 +658,22 @@ function run()
 			break;						
 		
 		case 95: // free path checking
 			
 			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
-			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+
+			$DB->query(
+			    'SELECT type, object_id, lang
+	 				  FROM nv_paths
+					 WHERE path = :path
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':path' => $path,
+                        ':wid' => $website->id
+                    )
+                );
 			
 			$rs = $DB->result();
 			
 			echo json_encode($rs);
 			
@@ -647,15 +687,18 @@ function run()
 
 		case 'json_find_user': // json find user by name request (for "moderator" autocomplete)
 			$DB->query('
 				SELECT id, username as text
 				  FROM nv_users
-				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
+				 WHERE username LIKE :username
 		      ORDER BY username ASC
 			     LIMIT 30',
-				'array
-			');
+				'array',
+				array(
+				    ':username' => '%' . $_REQUEST['username'] . '%'
+                )
+			);
 						
 			$rows = $DB->result();
             $total = $DB->foundRows();
 
             if(empty($_REQUEST['format']) || $_REQUEST['format']=='select2')
@@ -675,62 +718,73 @@ function run()
 
         case 'json_find_item':
             // find items by its title
             // any language
 
+            $text = $_REQUEST['title'];
+            if(!empty($_REQUEST['term'])) // tagit request
+                $text = $_REQUEST['term'];
+
+            $query_params = array(
+                ':wid' => $website->id,
+                ':lang' => $website->languages_published[0],
+                ':text' => '%' . $text . '%'
+            );
+
             $template_filter = '';
 
 	        if(!empty($_REQUEST['template']))
-                $template_filter = ' AND nvi.template = '.protect($_REQUEST['template']).' ';
+            {
+                $template_filter = ' AND nvi.template = :template ';
+                $query_params[':template'] = $_REQUEST['template'];
+            }
 
 	        if(!empty($_REQUEST['association']))
-                $template_filter = ' AND nvi.association = '.protect($_REQUEST['association']).' ';
+            {
+                $template_filter = ' AND nvi.association = :association ';
+                $query_params[':association'] = $_REQUEST['association'];
+            }
 
 	        if(isset($_REQUEST['embedding']))
-                $template_filter = ' AND nvi.embedding = '.protect($_REQUEST['embedding']).' ';
-
-            $text = $_REQUEST['title'];
-            if(!empty($_REQUEST['term'])) // tagit request
-                $text = $_REQUEST['term'];
+            {
+                $template_filter = ' AND nvi.embedding = :embedding ';
+                $query_params[':embedding'] = $_REQUEST['embedding'];
+            }
 
             $limit = intval($_REQUEST['page_limit']);
             if(empty($limit)) $limit = null;
             $limit = value_or_default($limit, 1000);
-            
+
             $sql = '
 				SELECT SQL_CALC_FOUND_ROWS DISTINCT nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_items nvi
 				 WHERE nvw.node_type = "item"
 				   AND nvw.node_id = nvi.id
 				   '.$template_filter.'
 				   AND nvw.subtype = "title"
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvi.website
-				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
-				        OR
-				        ( nvi.id LIKE  ' . protect('%' . $text . '%') . ' 
-				          AND
-				          nvw.lang = '.protect($website->languages_published[0]).'
-				        )
-				       )
+				   AND ( nvw.text LIKE :text 
+				         OR ( nvi.id LIKE :text AND nvw.lang = :lang )
+				   )
 		        GROUP BY nvw.node_id, nvw.text
 		        ORDER BY nvw.text ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query($sql, 'array', $query_params);
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
 			if($_REQUEST['association']=='free')
 			{
 				for($i = 0; $i < count($rows); $i++)
 				{
 					$rows[$i]['path'] = $DB->query_single(
 						'path',
 						'nv_paths',
-						'	website = '.protect($website->id).' AND 
+						'	website = '.intval($website->id).' AND 
 							type="item" AND 
 							object_id="'.$rows[$i]['id'].'" AND 
 							lang="'.$website->languages_list[0].'"
 						'
 					);
@@ -2090,11 +2144,11 @@ function items_form($item)
 			$properties_html = navigate_property_layout_form('item', $item->template, 'item', $item->id);
 		}
 		else if($item->association == 'category' && ($item->category > 0))
 		{
 			// we have to get the template set in the category of the item
-			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($item->category).' AND website = '.$website->id);
+			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.intval($item->category).' AND website = '.intval($website->id));
 			$properties_html = navigate_property_layout_form('item', $template_id, 'item', $item->id);
 		}
 
 		if(!empty($properties_html))
 		{
@@ -2151,19 +2205,21 @@ function items_form($item)
 			// script#7
 			
 			// comments list
 			// removed filter: AND nvwu.website = nvc.website ... reason: the webuser could be from another website if sharing webusers is enabled
 			// TODO: retrieve comments by AJAX call to avoid memory issues. right now we just retrieve the first 500 comments
-			$DB->query('SELECT nvc.*, nvwu.username, nvwu.avatar
-						  FROM nv_comments nvc
-						 LEFT OUTER JOIN nv_webusers nvwu 
-						 			  ON nvwu.id = nvc.user
-						 WHERE nvc.website = '.protect($website->id).'
-						   AND nvc.object_type = "item"
-						   AND nvc.object_id = '.protect($item->id).'
-						ORDER BY nvc.date_created ASC
-						LIMIT 500');
+			$DB->query(
+			    'SELECT nvc.*, nvwu.username, nvwu.avatar
+                      FROM nv_comments nvc
+                     LEFT OUTER JOIN nv_webusers nvwu 
+                                  ON nvwu.id = nvc.user
+                     WHERE nvc.website = '.intval($website->id).'
+                       AND nvc.object_type = "item"
+                       AND nvc.object_id = '.intval($item->id).'
+                    ORDER BY nvc.date_created ASC
+                    LIMIT 500'
+            );
 												
 			$comments = $DB->result();
 			$comments_total = count($comments);
 			
 			for($c=0; $c < $comments_total; $c++)
diff --git a/lib/packages/orders/order.class.php b/lib/packages/orders/order.class.php
index 7efaa15e..97119887 100644
--- a/lib/packages/orders/order.class.php
+++ b/lib/packages/orders/order.class.php
@@ -144,11 +144,11 @@ class order
         global $DB;
 
         $DB->query('
             SELECT * 
             FROM nv_orders_lines 
-            WHERE `order` = '.protect($this->id).' 
+            WHERE `order` = '.intval($this->id).' 
             ORDER BY position ASC'
         );
         $this->lines = $DB->result();
     }
 
@@ -663,11 +663,16 @@ class order
             $website_id = $website->id;
 
         $order_id = $DB->query_single(
             'id',
             'nv_orders',
-            'reference = '.protect($reference).' AND website = "'.$website_id.'"'
+            'reference = :reference AND website = :wid',
+            NULL,
+            array(
+                ':wid' => $website_id,
+                ':reference' => $reference
+            )
         );
 
         return $order_id;
     }
 
@@ -719,11 +724,11 @@ class order
     public function backup($type='json')
     {
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_orders WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_orders WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/orders/orders.php b/lib/packages/orders/orders.php
index e22be971..c1366354 100644
--- a/lib/packages/orders/orders.php
+++ b/lib/packages/orders/orders.php
@@ -28,15 +28,20 @@ function run()
 					break;
 
                 case 'find_webuser': // json find webuser by name (for "webuser" autocomplete)
                     $DB->query('SELECT id, username as text
 						  FROM nv_webusers
-						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
-						   AND website = '.$website->id.'
+						 WHERE username LIKE :username
+						   AND website = :wid
 				      ORDER BY username ASC
 					     LIMIT 30',
-                        'array');
+                        'array',
+                        array(
+                            ':wid' => $website->id,
+                            ':username' => '%' . $_REQUEST['username'] . '%'
+                        )
+                    );
 
                     $rows = $DB->result();
                     $total = $DB->foundRows();
                     echo json_encode(array('items' => $rows, 'totalCount' => $total));
 
diff --git a/lib/packages/paths/path.class.php b/lib/packages/paths/path.class.php
index d197359b..cfb15c42 100644
--- a/lib/packages/paths/path.class.php
+++ b/lib/packages/paths/path.class.php
@@ -135,13 +135,19 @@ class path
 			$website_id = $website->id;
 
 		$ok = $DB->query('
 			SELECT *
 			  FROM nv_paths
-			 WHERE type = '.protect($type).'
-			   AND object_id = '.protect($object_id).'
-			   AND website = '.$website_id
+			 WHERE type = :type
+			   AND object_id = :object_id
+			   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website_id,
+                ':object_id' => $object_id,
+                ':type' => $type
+            )
 		);
 
 	    if(!$ok)
 		    throw new Exception($DB->get_last_error());
     
@@ -162,29 +168,44 @@ class path
 	{
 		global $DB;
 		global $website;
 
 		if(empty($website_id))
-			$website_id = $website->id;
+		{
+            $website_id = $website->id;
+        }
 		
-	    if(empty($object_id)) throw new Exception('ERROR path: No ID!');
+	    if(empty($object_id))
+        {
+            throw new Exception('ERROR path: No ID!');
+        }
 
 		// delete old entries
 		$DB->execute('
 			DELETE FROM nv_paths
-			WHERE type = '.protect($type).'
-			  AND object_id = '.protect($object_id).'
-			  AND website = '.$website_id
+			WHERE type = :type
+			  AND object_id = :object_id
+			  AND website = :wid',
+            array(
+                ':wid' => $website_id,
+                ':object_id' => $object_id,
+                ':type' => $type
+            )
 		);
 
         if(!is_array($paths))
+        {
             return;
+        }
 
 		// and now insert the new values
 		foreach($paths as $lang => $path)
 		{
-    	  	if(empty($path)) continue;
+    	  	if(empty($path))
+            {
+                continue;
+            }
     
 			$ok = $DB->execute('
  				INSERT INTO nv_paths
 				(id, website, type, object_id, lang, path, cache_file, cache_expires, views)
 				VALUES
@@ -198,11 +219,14 @@ class path
 					':path' => $path,
                     ':views' => 0,
 				)
 			);
   			
-  			if(!$ok) throw new Exception($DB->get_last_error());
+  			if(!$ok)
+            {
+                throw new Exception($DB->get_last_error());
+            }
 		}
 		
 	}
 
     public function backup($type='json')
@@ -212,11 +236,11 @@ class path
 
         $out = array();
 
         $DB->query('
 			SELECT * FROM nv_paths
-			WHERE website = '.protect($website->id),
+			WHERE website = '.intval($website->id),
 	        'object'
         );
         $out = $DB->result();
 
         if($type='json')
diff --git a/lib/packages/payment_methods/payment_method.class.php b/lib/packages/payment_methods/payment_method.class.php
index d5ee823c..e62c06a3 100644
--- a/lib/packages/payment_methods/payment_method.class.php
+++ b/lib/packages/payment_methods/payment_method.class.php
@@ -310,11 +310,11 @@ class payment_method
     public function backup($type='json')
     {
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/permissions/permission.class.php b/lib/packages/permissions/permission.class.php
index 1d641789..af8c3745 100644
--- a/lib/packages/permissions/permission.class.php
+++ b/lib/packages/permissions/permission.class.php
@@ -22,18 +22,24 @@ class permission
     {
         global $DB;
 
         $ws_query = '';
         if(!empty($website))
-            $ws_query = ' AND website = '.protect($website);
+            $ws_query = ' AND website = '.intval($website);
 
         $status = $DB->query('
             SELECT * FROM nv_permissions
-             WHERE name = '.protect($name).'
-               AND profile = '.intval($profile_id).'
-               AND user = '.intval($user_id).
-            $ws_query
+             WHERE name = :name 
+               AND profile = :profile_id 
+               AND user = :user_id',
+            $ws_query,
+            'object',
+            array(
+                ':name' => $name,
+                ':profile_id' => intval($profile_id),
+                ':user_id' => intval($user_id)
+            )
         );
 
         if($status)
         {
             $data = $DB->result();
@@ -274,29 +280,44 @@ class permission
         if($who=='user')
         {
             $DB->query('
                 SELECT *
                 FROM nv_permissions
-                WHERE profile = '.protect($object->profile).'
-                  AND (website = 0 OR website = '.protect($ws).')'
+                WHERE profile = :profile
+                  AND (website = 0 OR website = :wid)',
+                'object',
+                array(
+                    ':profile' => $object->profile,
+                    ':wid' => $ws
+                )
             );
             $permissions_profile = $DB->result();
 
             $DB->query('
                 SELECT *
                   FROM nv_permissions
-                 WHERE user = '.protect($object->id).'
-                   AND (website = 0 OR website = '.protect($ws).')'
+                 WHERE user = :object_id
+                   AND (website = 0 OR website = :wid)',
+            'object',
+                array(
+                    ':wid' => $ws,
+                    ':object_id' => $object->id
+                )
             );
             $permissions_user = $DB->result();
         }
         else if($who=='profile')
         {
             $DB->query('
                 SELECT * FROM nv_permissions
-                 WHERE profile = '.protect($object->id).'
-                 AND (website = 0 OR website = '.protect($ws).')'
+                 WHERE profile = :object_id
+                 AND (website = 0 OR website = :wid)',
+                'object',
+                array(
+                    ':wid' => $ws,
+                    ':object_id' => $object->id
+                )
             );
 
             $permissions_profile = $DB->result();
             $permissions_user = array();
         }
diff --git a/lib/packages/products/product.class.php b/lib/packages/products/product.class.php
index 85e2fdb3..c1b5bb5e 100644
--- a/lib/packages/products/product.class.php
+++ b/lib/packages/products/product.class.php
@@ -724,13 +724,13 @@ class product
         if(empty($this->_comments_count))
         {
             $DB->query('
                 SELECT COUNT(*) as total
                       FROM nv_comments
-                     WHERE website = ' . protect($this->website) . '
+                     WHERE website = ' . intval($this->website) . '
                        AND object_type = "product"
-                       AND object_id = ' . protect($this->id) . '
+                       AND object_id = ' . intval($this->id) . '
                        AND status = 0'
             );
 
             $out = $DB->result('total');
             $this->_comments_count = $out[0];
@@ -795,23 +795,27 @@ class product
 		$search = explode(" ", $text);
 		$search = array_filter($search);
 		sort($search);
 		foreach($search as $text)
 		{
-			$like = ' LIKE '.protect('%'.$text.'%');
-
 			// we search for the IDs at the dictionary NOW (to avoid inefficient requests)
-			$DB->query('SELECT DISTINCT (nvw.node_id)
-						 FROM nv_webdictionary nvw
-						 WHERE nvw.node_type = "product"
-						   AND nvw.website = '.$website->id.'
-						   AND nvw.text '.$like, 'array');
+			$DB->query(
+			    'SELECT DISTINCT (nvw.node_id)
+                     FROM nv_webdictionary nvw
+                     WHERE nvw.node_type = "product"
+                       AND nvw.website = '.$website->id.'
+                       AND nvw.text LIKE :text',
+                'array',
+                array(
+                    ':text' => '%'.$text.'%'
+                )
+            );
 
 			$dict_ids = $DB->result("node_id");
 
 			// all columns to look for
-			$cols[] = 'p.id' . $like;
+			$cols[] = 'p.id LIKE ' .  protect('%'.$text.'%').' ';
 			if(!empty($dict_ids))
 				$cols[] = 'p.id IN ('.implode(',', $dict_ids).')';
 
 			$where .= ' AND ( ';
 			$where .= implode( ' OR ', $cols);
@@ -825,11 +829,11 @@ class product
     {
         global $DB;
         global $website;
 
         $out = array();
-        $DB->query('SELECT * FROM nv_products WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_products WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/products/products.php b/lib/packages/products/products.php
index 80c7830f..28953d96 100644
--- a/lib/packages/products/products.php
+++ b/lib/packages/products/products.php
@@ -35,32 +35,35 @@ function run()
 					}
 					echo json_encode(true);
 					break;
 
                 case 'products_by_tag':
-                    $tag = $_REQUEST['tag'];
-                    $lang = $_REQUEST['lang'];
-
                     $DB->query('
                         SELECT p.id, p.access, p.date_created AS date, d.text as title                               
                                FROM nv_products p
                           LEFT JOIN nv_webdictionary d
                                      ON p.id = d.node_id
                                     AND d.node_type = "product"
                                     AND d.subtype = "title"
-                                    AND d.lang = '.protect($lang).'
-                                    AND d.website = '.$website->id.'
+                                    AND d.lang = :lang
+                                    AND d.website = :wid
                             WHERE p.id IN (
                                 SELECT node_id FROM nv_webdictionary
-                                 WHERE website = ' . $website->id . '
+                                 WHERE website = :wid
                                    AND node_type = "product"
                                    AND subtype = "tags"
-                                   AND lang = ' . protect($lang) . '
-                                   AND FIND_IN_SET('.protect($tag).', text) > 0
+                                   AND lang = :lang
+                                   AND FIND_IN_SET(:tag, text) > 0
                             )
-                        ORDER BY p.id DESC
-                    ');
+                        ORDER BY p.id DESC',
+                        'object',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $_REQUEST['lang'],
+                            ':tag' => $_REQUEST['tag']
+                        )
+                    );
 
                     $rs = $DB->result();
 
                     for($r=0; $r < count($rs); $r++)
                         $rs[$r]->date = core_ts2date($rs[$r]->date);
@@ -104,11 +107,11 @@ function run()
 				
 					$page       =   intval($_REQUEST['page']);
 					$max	    =   intval($_REQUEST['rows']);
 					$offset     =   ($page - 1) * $max;
 					$orderby    =   $_REQUEST['sidx'].' '.$_REQUEST['sord'];
-					$where      =   ' p.website = '.$website->id;
+					$where      =   ' p.website = :wid';
 
 					if($_REQUEST['_search']=='true' || isset($_REQUEST['quicksearch']))
 					{
 						if(isset($_REQUEST['quicksearch']))
                         {
@@ -151,35 +154,46 @@ function run()
 						}
 						else	// single search
 							$where .= ' AND '.navitable::jqgridcompare($_REQUEST['searchField'], $_REQUEST['searchOper'], $_REQUEST['searchString']);
 					}
 
-					$sql = ' SELECT SQL_CALC_FOUND_ROWS
-					                p.*, d.text as title, d.lang as language,
-                                    u.username as author_username,
-                                    (   SELECT COUNT(*)
-                                        FROM nv_comments cm
-                                        WHERE cm.object_type = "product"
-                                          AND cm.object_id = p.id
-                                          AND cm.website = '.$website->id.'
-                                    ) as comments
-							   FROM nv_products p
-						  LEFT JOIN nv_webdictionary d
-						  		 	 ON p.id = d.node_id
-								 	AND d.node_type = "product"
-									AND d.subtype = "title"
-									AND d.lang = '.protect($website->languages_list[0]).'
-									AND d.website = '.$website->id.'
-						  LEFT JOIN nv_users u
-						  			 ON u.id = p.author
-							  WHERE '.$where.'							   
-						   ORDER BY '.$orderby.' 
-							  LIMIT '.$max.'
-							 OFFSET '.$offset;
-
-					if(!$DB->query($sql, 'array'))
-						throw new Exception($DB->get_last_error());
+                    $query_params = array(
+                        ':wid' => $website->id,
+                        ':lang' => $website->languages_list[0]
+                    );
+
+					$ok = $DB->query(
+					    'SELECT SQL_CALC_FOUND_ROWS
+                                p.*, d.text as title, d.lang as language,
+                                u.username as author_username,
+                                (   SELECT COUNT(*)
+                                    FROM nv_comments cm
+                                    WHERE cm.object_type = "product"
+                                      AND cm.object_id = p.id
+                                      AND cm.website = :wid
+                                ) as comments
+                           FROM nv_products p
+                      LEFT JOIN nv_webdictionary d
+                                 ON p.id = d.node_id
+                                AND d.node_type = "product"
+                                AND d.subtype = "title"
+                                AND d.lang = :lang
+                                AND d.website = :wid
+                      LEFT JOIN nv_users u
+                                 ON u.id = p.author
+                          WHERE '.$where.'							   
+                       ORDER BY '.$orderby.' 
+                          LIMIT '.$max.'
+                         OFFSET '.$offset,
+                        'array',
+                        $query_params
+                    );
+
+					if(!$ok)
+					{
+                        throw new Exception($DB->get_last_error());
+                    }
 
 					$dataset = $DB->result();	
 					$total = $DB->foundRows();
 
 					$dataset = grid_notes::summary($dataset, 'item', 'id');
@@ -456,19 +470,27 @@ function run()
 
 			core_terminate();
 			break;
 
 		case "load_content_history":
-			$DB->query('SELECT id, date_created, autosave
-						  FROM nv_webdictionary_history
-						 WHERE node_type = "product"
-						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-						   AND lang = '.protect($_GET['lang']).'
-						   AND node_id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id.' 
-				      ORDER BY date_created DESC',
-						'array');		
+			$DB->query(
+			    'SELECT id, date_created, autosave
+                      FROM nv_webdictionary_history
+                     WHERE node_type = "product"
+                       AND subtype = :subtype
+                       AND lang = :lang
+                       AND node_id = :node_id
+                       AND website = :wid 
+                  ORDER BY date_created DESC',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':node_id' => $_REQUEST['id'],
+                    ':subtype' => 'section-'.$_REQUEST['section']
+                )
+            );
 			
 			$result = $DB->result();
 			
 			if(!is_array($result)) $result = array();
 			for($i=0; $i < count($result); $i++)
@@ -488,16 +510,21 @@ function run()
 			$DB->query('
 				SELECT node_id as id, text as label, text as value
 				  FROM nv_webdictionary
 				 WHERE node_type = "product"
 				   AND subtype = "title"
-				   AND lang = '.protect($_REQUEST['lang']).'
-				   AND website = '.$website->id.'
-				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+				   AND lang = :lang
+				   AND website = :wid
+				   AND text LIKE :text
 		      ORDER BY text ASC
 			     LIMIT 20',
-				'array'
+				'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%' . $_REQUEST['title'] . '%'
+                )
 			);
 
 			echo json_encode($DB->result());
 
 			core_terminate();
@@ -508,44 +535,62 @@ function run()
 			if(empty($_REQUEST['section']))
 				$_REQUEST['section'] = 'main';
 		
 			if($_REQUEST['history']=='true')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary_history
-							 WHERE node_type = "product"
-							   AND website = '.$website->id.' 
-							   AND id = '.protect($_REQUEST['id']),							   
-							'array');	
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary_history
+                         WHERE node_type = "product"
+                           AND website = '.intval($website->id).' 
+                           AND id = '.intval($_REQUEST['id']),
+                    'array'
+                );
 							
 				$data = $DB->first();				
 				echo $data['text'];		
 			}
 			else if($_REQUEST['zone'] == 'section')
 			{		
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "product"
-							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.' 
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "product"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':subtype' => 'section-'.$_REQUEST['section'],
+                        ':node_id' => $_REQUEST['node_id']
+                    )
+                );
 
 				$data = $DB->first();				
 				echo $data['text'];
 			}
 			else if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-product"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "property-product"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
+                        ':lang' => $_REQUEST['lang'],
+                        ':wid' => $website->id,
+                        ':node_id' => $_REQUEST['node_id']
+                    )
+                );
 
 				$data = $DB->first();
 				echo $data['text'];
 			}
 							  
@@ -600,17 +645,20 @@ function run()
 							  
 			core_terminate();
 			break;
 
         case 'path_free_check':
-			$path = $_REQUEST['path'];
-
 			$DB->query('
                 SELECT type, object_id, lang
                   FROM nv_paths
-                 WHERE path = '.protect($path).'
-                   AND website = '.$website->id
+                 WHERE path = :path
+                   AND website = :wid',
+            'object',
+                array(
+                    ':wid' => $website->id,
+                    ':path' => $_REQUEST['path']
+                )
             );
 			
 			$rs = $DB->result();
 			echo json_encode($rs);
 
@@ -621,12 +669,17 @@ function run()
 			$sku = trim($_REQUEST['sku']);
 
 			$DB->query('
                 SELECT id
                   FROM nv_products
-                 WHERE sku = '.protect($sku).'
-                   AND website = '.$website->id
+                 WHERE sku = :sku
+                   AND website = :wid',
+            'object',
+                array(
+                    ':sku' => $sku,
+                    ':wid' => $website->id
+                )
             );
 
 			$rs = $DB->result();
 			echo json_encode($rs);
 
@@ -640,15 +693,18 @@ function run()
 
 		case 'json_find_user': // json find user by name request (for "moderator"/"author" autocomplete)
 			$DB->query('
 				SELECT id, username as text
 				  FROM nv_users
-				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
+				 WHERE username LIKE :username
 		      ORDER BY username ASC
 			     LIMIT 30',
-				'array
-			');
+				'array',
+                array(
+                    ':username' => '%'.$_REQUEST['username'].'%'
+                )
+            );
 						
 			$rows = $DB->result();
             $total = $DB->foundRows();
 
             if(empty($_REQUEST['format']) || $_REQUEST['format']=='select2')
@@ -668,45 +724,51 @@ function run()
 
         case 'json_find_product':
             // find items by its title
             // any language
 
-            $template_filter = '';
-
-	        if(!empty($_REQUEST['template']))
-                $template_filter = ' AND nvp.template = '.protect($_REQUEST['template']).' ';
-
             $text = $_REQUEST['title'];
             if(!empty($_REQUEST['term'])) // tagit request
+            {
                 $text = $_REQUEST['term'];
+            }
+
+            $query_params = array(
+                ':wid' => $website->id,
+                ':lang' => $website->languages_published[0],
+                ':text' => '%' . $text . '%'
+            );
+
+            $template_filter = '';
+            if(!empty($_REQUEST['template']))
+            {
+                $template_filter = ' AND nvp.template = :template ';
+                $query_params[':template'] = $_REQUEST['template'];
+            }
 
             $limit = intval($_REQUEST['page_limit']);
             if(empty($limit)) $limit = null;
             $limit = value_or_default($limit, 1000);
-            
+
             $sql = '
 				SELECT SQL_CALC_FOUND_ROWS DISTINCT nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_products nvp
 				 WHERE nvw.node_type = "product"
 				   AND nvw.node_id = nvp.id
 				   '.$template_filter.'
 				   AND nvw.subtype = "title"
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvp.website
-				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
-				        OR
-				        ( nvp.id LIKE  ' . protect('%' . $text . '%') . ' 
-				          AND
-				          nvw.lang = '.protect($website->languages_published[0]).'
-				        )
+				   AND ( nvw.text LIKE :text 
+				        OR ( nvp.id LIKE :text AND nvw.lang = :lang )
 				       )
 		        GROUP BY nvw.node_id, nvw.text
 		        ORDER BY nvw.text ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query($sql, 'array', $query_params);
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
 			if(empty($_REQUEST['format']) || $_REQUEST['format']=='select2')
             {
@@ -735,18 +797,24 @@ function run()
 
             $sql = '
 				SELECT SQL_CALC_FOUND_ROWS nvb.*
 				  FROM nv_brands nvb
 				 WHERE nvb.website = '.$website->id.' AND ( 
-				         nvb.name LIKE ' . protect('%' . $text . '%') . '    OR
-				         nvb.id LIKE   ' . protect('%' . $text . '%') . '
+				         nvb.name LIKE :text OR
+				         nvb.id LIKE :text
                        )
 		        ORDER BY nvb.name ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query(
+                $sql,
+                'array',
+                array(
+                    ':text' => '%' . $text . '%'
+                )
+            );
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
 			if(empty($_REQUEST['format']) || $_REQUEST['format']=='select2')
             {
@@ -1462,11 +1530,13 @@ function products_form($item)
 		'div_template_select'
     );
 
 	$brand_name = "";
 	if(!empty($item->brand))
+    {
         $brand_name = $DB->query_single('name', 'nv_brands', 'id = '.intval($item->brand));
+    }
 
     $navibars->add_tab_content_row(
         array(
             '<label>'.t(662, 'Brand').'</label>',
             $naviforms->autocomplete('product-brand', $brand_name, '?fid=products&act=json_find_brand&format=autocomplete', '""', NULL, true),
@@ -2108,13 +2178,13 @@ function products_form($item)
 			$DB->query('
                 SELECT nvc.*, nvwu.username, nvwu.avatar
                   FROM nv_comments nvc
                  LEFT OUTER JOIN nv_webusers nvwu 
                               ON nvwu.id = nvc.user
-                 WHERE nvc.website = '.protect($website->id).'
+                 WHERE nvc.website = '.intval($website->id).'
                    AND nvc.object_type = "product"
-                   AND nvc.object_id = '.protect($item->id).'
+                   AND nvc.object_id = '.intval($item->id).'
                 ORDER BY nvc.date_created ASC
                 LIMIT 500
             ');
 												
 			$comments = $DB->result();
diff --git a/lib/packages/properties/property.class.php b/lib/packages/properties/property.class.php
index a7e48fd1..d9a7ab4f 100644
--- a/lib/packages/properties/property.class.php
+++ b/lib/packages/properties/property.class.php
@@ -480,25 +480,37 @@ class property
         if(empty($website_id))
             $website_id = $website->id;
 
         if(is_numeric($code))
         {
+            $query_params = array(
+                ':template' => $code,
+                ':wid' => $website_id
+            );
+
             // properties attached to a custom template (not a theme template)
             if(!empty($element))
-                $element = ' AND element = '.protect($element);
+            {
+                $element = ' AND element = :element ';
+                $query_params[':element'] = $element;
+            }
             else
+            {
                 $element = ' AND element != "block"';
+            }
 
-            if($DB->query('
-                   SELECT *
-                   FROM nv_properties
-                   WHERE template = '.protect($code).'
-                   '.$element.'
-                     AND website = '.$website_id.'
-                   ORDER BY position ASC, id ASC'
-                )
-            )
+            $ok = $DB->query(
+            'SELECT * FROM nv_properties
+                 WHERE template = :template
+                  '.$element.'
+                  AND website = :wid
+                ORDER BY position ASC, id ASC',
+                'object',
+                $query_params
+            );
+
+            if($ok)
             {
                 $data = $DB->result();
             }
         }
         else
@@ -740,11 +752,16 @@ class property
             if(!empty($code))
             {
                 $block_group_id = $DB->query_single(
                     'MAX(id)',
                     'nv_block_groups',
-                    ' code = '.protect($code).' AND website = '.$website->id
+                    ' code = :code AND website = :wid',
+                    NULL,
+                    array(
+                        ':wid' => $website->id,
+                        ':code' => $code
+                    )
                 );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
@@ -771,20 +788,38 @@ class property
             }
 
             if(empty($object_id))
             {
                 // we need to find the block_group ID by checking the block uid
-                $block_group_id = $DB->query_single('id', 'nv_block_groups', ' blocks LIKE '.protect('%'.$item_uid.'%').' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'id',
+                    'nv_block_groups',
+                    ' blocks LIKE :uid AND website = :wid',
+                    NULL,
+                    array(
+                        ':wid' => $website->id,
+                        ':uid' => '%'.$item_uid.'%'
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
             // we must find the REAL numeric block group ID (based on its code) to get the assigned property values
             // at the end, $object_id MUST BE the numeric ID of the block group (we have only its codename, not the numeric ID)
             else if(!empty($code))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :object_id AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':object_id' => $object_id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
 
@@ -804,17 +839,31 @@ class property
 		// load the values for multilanguage strings
 		$dictionary = webdictionary::load_element_strings('property-'.$object_type, $object_id, $item_uid);
 
     	// load the assigned (simple) properties values
         // check node_uid empty or NULL to mantain compatibility with Navigate CMS < 2.2
+        $query_params = array(
+            ':wid' => $website->id,
+            ':object_type' => $object_type,
+            ':object_id' => $object_id
+        );
+
+        $uid_filter = '';
+        if(!empty($item_uid))
+        {
+            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
+            $query_params[':node_uid'] = $item_uid;
+        }
+
 		$DB->query('
 		    SELECT * FROM nv_properties_items
- 			 WHERE element = '.protect($object_type).'
-			   AND node_id = '.protect($object_id).
-			   (empty($item_uid)? '' : ' AND ( node_uid = '.protect($item_uid).' OR node_uid = "" OR node_uid IS NULL )').'
-			   AND website = '.$website->id,
-            'array'
+ 			 WHERE element = :object_type
+			   AND node_id = :object_id
+			   '.$uid_filter.'			   
+			   AND website = :wid',
+            'array',
+            $query_params
         );
 
 		$values = $DB->result();
         
 		if(!is_array($values))
@@ -880,11 +929,20 @@ class property
             $block = block::block_group_block($code, $element);
             $properties = $block->properties;
 
             if(!is_numeric($object_id))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :code AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':code' => $code
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
         }
@@ -910,11 +968,20 @@ class property
 
             // we must find the REAL numeric block group ID (based on its code) to get the assigned property values
             // $object_id MUST BE the numeric ID of the block group (we have only its codename, not the numeric ID)
             if(!empty($code))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :object_id AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':object_id' => $object_id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
 
@@ -969,19 +1036,34 @@ class property
             // if we don't set an empty value, Navigate would take that as non-existant field and would set the default value,
             // which is different as the user may really want to set "empty" as the value
             if(($property->type=='element' || $property->type=='item') && !isset($_REQUEST['property-'.$property->id]))
                 $property_value = "";
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':property_id' => $property->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            );
+
+            $uid_filter = '';
+            if(!empty($object_uid))
+            {
+                $uid_filter = ' AND node_uid = :object_uid ';
+                $query_params[':object_uid'] = $object_uid;
+            }
+
             // remove the old property row
             $DB->execute('
                 DELETE
                      FROM nv_properties_items
-                    WHERE property_id = '.protect($property->id).'
-                      AND element = '.protect($object_type).'
-                      AND node_id = '.protect($object_id).
-                      (empty($object_uid)? '' : ' AND node_uid = '.protect($object_uid)).'
-                      AND website = '.$website->id
+                    WHERE property_id = :property_id
+                      AND element = :object_type
+                      AND node_id = :object_id
+                      '.$uid_filter.'
+                      AND website = :wid',
+                $query_params
             );
 
             // now insert the new row
             $DB->execute('
                 INSERT INTO nv_properties_items
@@ -1076,11 +1158,20 @@ class property
             // we have to identify the block subtype: block, block_type, block_group_block or extension_block
             // so we can get its properties definition
             if(!is_numeric($object_id))
             {
                 // assume there can only be one block group of the same type
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$ws->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :code AND website = :wid',
+                    null,
+                    array(
+                        ':code' => $code,
+                        ':wid' => $ws->id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
             }
 
@@ -1202,17 +1293,33 @@ class property
 
             if(is_null($value))
                 $value = ""; // should not be needed because of value_or_default, but doing this here fixes some warnings
 
             // remove the old property value row
+
+            $query_params = array(
+                ':wid' => $ws->id,
+                ':object_id' => $object_id,
+                ':pr_object_type' => $property_object_type,
+                ':pr_id' => $property->id
+            );
+
+            $uid_filter = '';
+            if(!empty($node_uid))
+            {
+                $uid_filter = ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $node_uid;
+            }
+
             $DB->execute('
 				DELETE FROM nv_properties_items
-                	  WHERE property_id = '.protect($property->id).'
-                        AND element = '.protect($property_object_type).'
-                        AND node_id = '.protect($object_id).
-                        (empty($node_uid)? '' : ' AND node_uid = '.protect($node_uid)).'
-                        AND website = '.$ws->id
+                	  WHERE property_id = :pr_id
+                        AND element = :pr_object_type
+                        AND node_id = :object_id                        
+                        AND website = :wid
+                        '.$uid_filter,
+                $query_params
             );
 
             // now we insert a new row
             $DB->execute('
 			    INSERT INTO nv_properties_items
@@ -1273,26 +1380,38 @@ class property
 
         webdictionary::save_element_strings('property-'.$element_type, $element_id, array());
 
         $DB->execute('
             DELETE FROM nv_properties_items
-                  WHERE website = '.$website_id.'
-                    AND element = '.protect($element_type).'
-                    AND node_id = '.intval($element_id).'
-        ');
+                  WHERE website = :wid
+                    AND element = :e_type
+                    AND node_id = :e_id ',
+            array(
+                ':wid' => $website_id,
+                ':e_type' => $element_type,
+                ':e_id' => $element_id
+            )
+        );
     }
 
     public static function country_name_by_code($code, $language="")
     {
         global $DB;
 
         $lang = core_get_language($language);
 
-        $DB->query('SELECT name
-					FROM nv_countries
-		 			WHERE lang = '.protect($lang).'
-					  AND country_code = '.protect($code));
+        $DB->query(
+            'SELECT name
+			 	  FROM nv_countries
+		 		  WHERE lang = :lang
+				    AND country_code = :ccode',
+            'object',
+            array(
+                ':ccode' => $code,
+                ':lang' => $lang
+            )
+        );
 
         $row = $DB->first();
 
         return $row->name;
     }
@@ -1308,14 +1427,20 @@ class property
 
         $code = 'country_code';
         if($alpha3)
             $code = 'alpha3';
 
-		$DB->query('SELECT '.$code.' AS country_code, name
-					FROM nv_countries
-		 			WHERE lang = '.protect($lang).'
-					ORDER BY name ASC');
+		$DB->query(
+		    'SELECT '.$code.' AS country_code, name
+			  	  FROM nv_countries
+		 		  WHERE lang = :lang
+				  ORDER BY name ASC',
+            'object',
+            array(
+                ':lang' => $lang
+            )
+        );
 					
 		$rs = $DB->result();
 		
 		if(empty($rs))
 		{
@@ -1344,11 +1469,11 @@ class property
 
 		// note: regions have no translation to any language right now
 
         $country_query = " 1=1 ";
         if(!empty($country_id))
-            $country_query = ' AND r.country = '.protect($country_id);
+            $country_query = ' AND r.country = '.intval($country_id);
 
 		$DB->query('
             SELECT r.`numeric` AS region_id, c.country_code, r.name
             FROM nv_countries c, nv_countries_regions r
             WHERE c.lang = "en" AND
@@ -1368,13 +1493,15 @@ class property
         global $DB;
 
         // TODO: region names have no translation in database at this time
         // $lang = core_get_language($language);
 
-        $DB->query('SELECT name
-					FROM nv_countries_regions
-		 			WHERE `numeric` = '.protect($code));
+        $DB->query(
+            'SELECT name
+			  	  FROM nv_countries_regions
+		 		  WHERE `numeric` = '.intval($code)
+        );
 
         $row = $DB->first();
 
         return $row->name;
     }
@@ -1485,14 +1612,19 @@ class property
         global $DB;
         global $website;
 
         $DB->query('
             SELECT * FROM nv_properties_items
-            WHERE website = '.protect($website->id).'
-              AND property_id = '.protect($property).'
-              AND value = '.protect($value),
-            'object');
+            WHERE website = '.intval($website->id).'
+              AND property_id = :property_id 
+              AND value = :value',
+            'object',
+            array(
+                ':proeprty_id' => $property,
+                ':value' => $value
+            )
+        );
 
         return $DB->result();
     }
 	
     public function backup($type='json')
@@ -1500,16 +1632,16 @@ class property
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_properties WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_properties WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_properties'] = json_encode($DB->result());
 
-        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_properties_items'] = json_encode($DB->result());
 
         if($type='json')
diff --git a/lib/packages/properties/property.layout.php b/lib/packages/properties/property.layout.php
index 2a7fbdec..f1710a2d 100644
--- a/lib/packages/properties/property.layout.php
+++ b/lib/packages/properties/property.layout.php
@@ -1074,15 +1074,22 @@ function navigate_property_layout_field($property, $object="", $website_id="")
                     foreach ($values as $cid)
                     {
                         $content_title = $DB->query_single(
                             'text',
                             'nv_webdictionary',
-                            '    node_type = "structure" AND
-                                        website = "' . $ws->id . '" AND
-                                        node_id = ' . protect($cid) . ' AND
-                                        subtype = "title" AND
-                                        lang = "' . $ws->languages_published[0] . '"'
+                            '    
+                                node_type = "structure" AND
+                                website = :wid AND
+                                node_id = :node_id AND
+                                subtype = "title" AND
+                                lang = :lang',
+                            NULL,
+                            array(
+                                ':wid' => $ws->id,
+                                ':lang' => $ws->languages_published[0],
+                                ':node_id' => $cid
+                            )
                         );
 
                         $layout->add_script('
                             $("#property-' . $property->id . '").tagit("createTag", "' . $content_title . '", "", "", "' . $cid . '");                
                         ');
@@ -1328,15 +1335,22 @@ function navigate_property_layout_field($property, $object="", $website_id="")
                 foreach($values as $cid)
                 {
                     $content_title = $DB->query_single(
                         'text',
                         'nv_webdictionary',
-                        '   node_type = "item" AND
-                        website = "'.$ws->id.'" AND
-                        node_id = '.protect($cid).' AND
-                        subtype = "title" AND
-                        lang = "'.$ws->languages_published[0].'"'
+                        '   
+                            node_type = "item" AND
+                            website = :wid AND
+                            node_id = :node_id AND
+                            subtype = "title" AND
+                            lang = :lang',
+                        NULL,
+                        array(
+                            ':wid' => $ws->id,
+                            ':node_id' => $cid,
+                            ':lang' => $ws->languages_published[0]
+                        )
                     );
 
                     $layout->add_script('
                         $("#property-'.$property->id.'").tagit("createTag", "'.$content_title.'", "", "", "'.$cid.'");                
                     ');
diff --git a/lib/packages/shipping_methods/shipping_method.class.php b/lib/packages/shipping_methods/shipping_method.class.php
index 63f5ce6e..d4865cbe 100644
--- a/lib/packages/shipping_methods/shipping_method.class.php
+++ b/lib/packages/shipping_methods/shipping_method.class.php
@@ -264,11 +264,11 @@ class shipping_method
     public function backup($type='json')
     {
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
             $out = json_encode($out);
 
diff --git a/lib/packages/shipping_methods/shipping_methods.php b/lib/packages/shipping_methods/shipping_methods.php
index 771f3281..3e22fada 100644
--- a/lib/packages/shipping_methods/shipping_methods.php
+++ b/lib/packages/shipping_methods/shipping_methods.php
@@ -32,11 +32,19 @@ function run()
                     $shipping_method = new shipping_method();
 
                     if(!empty($shipping_method_id))
                         $shipping_method->load($shipping_method_id);
 
-                    $country_id = $DB->query_single('`numeric`', 'nv_countries', 'country_code = '.protect($country_code));
+                    $country_id = $DB->query_single(
+                        '`numeric`',
+                        'nv_countries',
+                        'country_code = :ccode',
+                        null,
+                        array(
+                            ':ccode' => $country_code
+                        )
+                    );
 
                     $DB->query('
                         SELECT `numeric`, name 
                         FROM nv_countries_regions 
                         WHERE country = '.$country_id.' 
@@ -433,11 +441,17 @@ function shipping_methods_form($object)
         $rate_country_name = @$country_names[array_search($rate->country, $country_codes)];
         $rate_regions = [];
         if(!empty($rate->regions))
         {
             foreach ($rate->regions as $rr)
-                $rate_regions[] = $DB->query_single('name', 'nv_countries_regions', '`numeric` = ' . protect($rr));
+            {
+                $rate_regions[] = $DB->query_single(
+                    'name',
+                    'nv_countries_regions',
+                    '`numeric` = ' . intval($rr)
+                );
+            }
         }
 
         $rate_weight =  ($rate->weight->min==0? '&infin;' : core_decimal2string($rate->weight->min)).
                         ' - '.
                         ($rate->weight->max==0? '&infin;' : core_decimal2string($rate->weight->max)).
diff --git a/lib/packages/structure/structure.class.php b/lib/packages/structure/structure.class.php
index c3012644..afd657da 100644
--- a/lib/packages/structure/structure.class.php
+++ b/lib/packages/structure/structure.class.php
@@ -184,12 +184,12 @@ class structure
         {
             // no position given, so find the first position free in the same parent (after all existing children)
             $DB->query('
 				SELECT MAX(position) as max_position
                   FROM nv_structure
-                 WHERE parent = '.protect($this->parent).'
-                   AND website = '.protect($this->website)
+                 WHERE parent = '.intval($this->parent).'
+                   AND website = '.intval($this->website)
             );
 
             $max = $DB->result('max_position');
             $this->position = intval($max[0]) + 1;
         }
@@ -387,12 +387,12 @@ class structure
         }
 
         $out = $DB->query_single(
             'COUNT(id)',
             'nv_items',
-            ' category = '.protect($this->id).' AND
-              website = '.protect($this->website).' AND
+            ' category = '.intval($this->id).' AND
+              website = '.intval($this->website).' AND
               permission <= '.$permission.' AND 
               (date_published = 0 OR date_published < '.core_time().') AND 
               (date_unpublish = 0 OR date_unpublish > '.core_time().') AND 
               (access = 0 OR access = '.$access.$access_extra.')
             ');
@@ -743,11 +743,11 @@ class structure
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_structure WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_structure WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/structure/structure.php b/lib/packages/structure/structure.php
index 597802ee..11a9a019 100644
--- a/lib/packages/structure/structure.php
+++ b/lib/packages/structure/structure.php
@@ -99,16 +99,21 @@ function run()
 
 
 		case 95: // free path checking
 			
 			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
 			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+			$DB->query(
+			    'SELECT type, object_id, lang
+	 			 	   FROM nv_paths
+					  WHERE path = :path 
+					    AND website = :wid',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':path' => $path
+                ));
 						 
 			$rs = $DB->result();
 			
 			echo json_encode($rs);
 			core_terminate();		
@@ -125,31 +130,40 @@ function run()
 
             $text = $_REQUEST['title'];
             if(!empty($_REQUEST['term'])) // tagit request
                 $text = $_REQUEST['term'];
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':text' => '%' . $text . '%'
+            );
+
             $language_filter = "";
             if(!empty($_REQUEST['lang']))
-                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
+            {
+                $language_filter = ' AND nvw.lang = :lang ';
+                $query_params[':lang'] = $_REQUEST['lang'];
+            }
 
 			$DB->query('
 				SELECT SQL_CALC_FOUND_ROWS nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_items nvi
 				 WHERE nvw.node_type = "item"
 				   AND nvw.node_id = nvi.id
 				   AND nvw.subtype = "title"
 				   AND (	nvi.association = "free" OR
-				            (nvi.association = "category" AND nvi.embedding=0)
+				            (nvi.association = "category" AND nvi.embedding = 0)
 				   )
 				   '.$language_filter.'
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvi.website
-				   AND nvw.text LIKE '.protect('%'.$text.'%').'
+				   AND nvw.text LIKE :text
 		      ORDER BY nvw.text ASC
 			     LIMIT '.intval($_REQUEST['page_limit']).'
 			     OFFSET '.max(0, (intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1))),
-				'array'
+				'array',
+                $query_params
 			);
 
             $rows = $DB->result();
             $total = $DB->foundRows();
 
@@ -177,24 +191,32 @@ function run()
 
             $text = $_REQUEST['title'];
             if(!empty($_REQUEST['term'])) // tagit request
                 $text = $_REQUEST['term'];
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':text' => '%'.$text.'%'
+            );
+
             $language_filter = "";
             if(!empty($_REQUEST['lang']))
-                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
+            {
+                $language_filter = ' AND nvw.lang = :lang ';
+                $query_params[':lang'] = $_REQUEST['lang'];
+            }
 
 			$DB->query('
 				SELECT SQL_CALC_FOUND_ROWS nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_structure nvs
 				 WHERE nvw.node_type = "structure"
 				   AND nvw.node_id = nvs.id
 				   AND nvw.subtype = "title"
 				   '.$language_filter.'
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvs.website
-				   AND nvw.text LIKE '.protect('%'.$text.'%').'
+				   AND nvw.text LIKE :text
 		      ORDER BY nvw.text ASC
 			     LIMIT '.intval($_REQUEST['page_limit']).'
 			     OFFSET '.max(0, (intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1))),
 				'array'
 			);
@@ -223,16 +245,21 @@ function run()
 			$DB->query('
 				SELECT node_id as id, text as label, text as value
 					  FROM nv_webdictionary
 					 WHERE node_type = "structure"
 					   AND subtype = "title"
-					   AND lang = '.protect($_REQUEST['lang']).'
-					   AND website = '.$website->id.'
-					   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+					   AND lang = :lang 
+					   AND website = :wid
+					   AND text LIKE :text
 			      ORDER BY text ASC
 				     LIMIT 30',
-					'array'
+					'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%'.$_REQUEST['title'].'%'
+                )
 			);
 
 			echo json_encode($DB->result());
 
 			core_terminate();
@@ -275,18 +302,25 @@ function run()
 
 		case "raw_zone_content": // return raw item contents
 
 			if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-structure"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                      FROM nv_webdictionary
+                     WHERE node_type = "property-structure"
+                       AND subtype = :subtype
+                       AND lang = :lang							   
+                       AND website = :wid
+                       AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
+                        ':node_id' => $_REQUEST['node_id']
+                    ));
 
 				$data = $DB->first();
 				echo $data['text'];
 			}
 
@@ -646,24 +680,24 @@ function structure_form($item)
             $parent = new structure();
             $parent->load($item->parent);
 
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$parent->id.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_first.png"> 
-                                        <small>('.strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
+                                        <small>('.mb_strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
                                     '</a>';
         }
 
         if(!empty($previous_brother))
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$previous_brother.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_previous.png"> 
-                                        <small>('.strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
+                                        <small>('.mb_strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
                                     '</a>';
 
         if(!empty($next_brother))
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$next_brother.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_next.png"> 
-                                        <small>('.strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
+                                        <small>('.mb_strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
                                     '</a>';
     }
 
     $events->add_actions(
         'structure',
diff --git a/lib/packages/templates/template.class.php b/lib/packages/templates/template.class.php
index 6e7d3e93..39761998 100644
--- a/lib/packages/templates/template.class.php
+++ b/lib/packages/templates/template.class.php
@@ -414,11 +414,11 @@ class template
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_templates WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_templates WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/templates/templates.php b/lib/packages/templates/templates.php
index 0b5ce44b..39e74573 100644
--- a/lib/packages/templates/templates.php
+++ b/lib/packages/templates/templates.php
@@ -933,11 +933,11 @@ function templates_section_widths()
 	global $DB;
 	global $website;
 	
 	$DB->query('SELECT sections
 				  FROM nv_templates
-				 WHERE website = '.protect($website->id),
+				 WHERE website = '.intval($website->id),
 				'array');
 				
 	$result = $DB->result();
 	
 	$widths = array();
diff --git a/lib/packages/themes/theme.class.php b/lib/packages/themes/theme.class.php
index 41d6b43d..be482083 100644
--- a/lib/packages/themes/theme.class.php
+++ b/lib/packages/themes/theme.class.php
@@ -184,19 +184,27 @@ class theme
             if(!empty($website->id))
             {
                 $DB->query('
                   SELECT subtype, lang, text
                     FROM nv_webdictionary
-                   WHERE website = '.$website->id.'
+                   WHERE website = :wid
                      AND node_type = "theme"
-                     AND lang = '.protect($current_language).'
-                     AND theme = '.protect($this->name)
+                     AND lang = :lang
+                     AND theme = :theme',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $current_language,
+                        ':theme' => $this->name
+                    )
                 );
                 $rs = $DB->result();
 
                 for($r=0; $r < count($rs); $r++)
+                {
                     $this->dictionary[$rs[$r]->subtype] = $rs[$r]->text;
+                }
             }
 		}
 
 		if(is_string($code))
 		{
@@ -1075,11 +1083,20 @@ class theme
 	        $template_id = $tmp->template;
 
 	        if($tmp->association != "free" && $tmp->embedding == 1)
 	        {
 		        // we have to get the template set in the category of the item
-				$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($tmp->category).' AND website = '.$website->id);
+				$template_id = $DB->query_single(
+				    'template',
+                    'nv_structure',
+                    ' id = :category AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':category' => $tmp->category
+                    )
+                );
 	        }
 
 	        $properties['item'][$tmp->id] = property::load_properties('item', $template_id, 'item', $tmp->id);
 
 	        list($tmp->dictionary, $files) = theme::export_sample_parse_dictionary($tmp->dictionary, $files);
@@ -1517,12 +1534,12 @@ class theme
                 {
                     // we have to get the template set in the category of the item
                     $template = $DB->query_single(
                         'template',
                         'nv_structure',
-                        ' id = '.protect($real[$el_id]->category).' AND 
-								  website = '.$ws->id
+                        ' id = '.intval($real[$el_id]->category).' AND 
+								  website = '.intval($ws->id)
                     );
                 }
             }
 
             property::save_properties_from_array($el, $real[$el_id]->id, $template, $el_properties_associative, $ws, $item_uid);
diff --git a/lib/packages/themes/themes.php b/lib/packages/themes/themes.php
index d5b42050..92bf1b77 100644
--- a/lib/packages/themes/themes.php
+++ b/lib/packages/themes/themes.php
@@ -19,11 +19,19 @@ function run()
             core_terminate();
             break;
 
         case 'remove':
             // check the theme is not actually used in any website
-            $usages = $DB->query_single('COUNT(*)', 'nv_websites', ' theme = '.protect($_REQUEST['theme']));
+            $usages = $DB->query_single(
+                'COUNT(*)',
+                'nv_websites',
+                ' theme = :theme',
+                null,
+                array(
+                    ':theme' => $_REQUEST['theme']
+                )
+            );
             if($usages == 0)
             {
                 try
                 {
                     $theme = new theme();
diff --git a/lib/packages/users/users.php b/lib/packages/users/users.php
index 6c9391e1..353970a5 100644
--- a/lib/packages/users/users.php
+++ b/lib/packages/users/users.php
@@ -330,11 +330,11 @@ function users_form($item)
 		)
 	);
 
 	// Thousands separator
 	$data = array(
-        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
+        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
         1	=> json_decode('{"code": ",", "name": ", ---> 1,234,567"}'),
         2	=> json_decode('{"code": ".", "name": ". ---> 1.234.567"}'),
 	);
 
 	$select = $naviforms->select_from_object_array('user-thousands_separator', $data, 'code', 'name', $item->thousands_separator);
diff --git a/lib/packages/users_log/users_log.class.php b/lib/packages/users_log/users_log.class.php
index e996bcb4..801cf029 100644
--- a/lib/packages/users_log/users_log.class.php
+++ b/lib/packages/users_log/users_log.class.php
@@ -133,24 +133,24 @@ class users_log
 		$DB->query('
 			SELECT DISTINCT nvul.website, nvul.function, nvul.item, nvul.item_title,
 							nvf.lid as function_title, nvf.icon as function_icon, nvul.date
 			FROM nv_users_log nvul, 
 				 nv_functions nvf
-			WHERE nvul.user = '.protect($user->id).'
+			WHERE nvul.user = '.intval($user->id).'
 			  AND nvul.function = nvf.id
 			  AND nvul.item > 0
 			  AND nvul.action = "load"
-			  AND nvul.website = '.protect($website->id).'
+			  AND nvul.website = '.intval($website->id).'
 			  AND nvul.item_title <> ""
 			  AND nvul.date > '.( core_time() - 30 * 86400).'
 			  AND nvul.date = (	SELECT MAX(nvulm.date) 
 			  					  FROM nv_users_log nvulm 
 			  					 WHERE nvulm.function = nvul.function 
 			  					   AND nvulm.item = nvul.item
 			  					   AND nvulm.item_title = nvul.item_title
-			  					   AND nvulm.website = '.protect($website->id).'
-			  					   AND nvulm.user = '.protect($user->id).'
+			  					   AND nvulm.website = '.intval($website->id).'
+			  					   AND nvulm.user = '.intval($user->id).'
 							   )
 			ORDER BY nvul.date DESC
 			LIMIT '.$limit
 		);
 
@@ -167,26 +167,33 @@ class users_log
 
 		// last month only!
 		$DB->query('
 			SELECT DISTINCT nvul.website, nvul.function, nvul.item, nvul.date
 			FROM nv_users_log nvul
-			WHERE nvul.user = '.protect($user->id).'
-			  AND nvul.function = '.protect($function).'
+			WHERE nvul.user = :user_id
+			  AND nvul.function = :function
 			  AND nvul.item > 0
-			  AND nvul.action = '.protect($action).'
-			  AND nvul.website = '.protect($website->id).'
+			  AND nvul.action = :action
+			  AND nvul.website = :wid
 			  AND nvul.date > '.( core_time() - 30 * 86400).'
 			  AND nvul.date = (	SELECT MAX(nvulm.date) 
 			  					  FROM nv_users_log nvulm 
 			  					 WHERE nvulm.function = nvul.function 
 			  					   AND nvulm.item = nvul.item
 			  					   AND nvulm.item_title = nvul.item_title
-			  					   AND nvulm.website = '.protect($website->id).'
-			  					   AND nvulm.user = '.protect($user->id).'
+			  					   AND nvulm.website = :wid
+			  					   AND nvulm.user = :user_id
 							   )
 			ORDER BY nvul.date DESC
-			LIMIT '.$limit
+			LIMIT '.$limit,
+        'object',
+            array(
+                ':wid' => $website->id,
+                ':action' => $action,
+                ':function' => $function,
+                ':user_id' => $user->id
+            )
 		);
 
 		$rows = $DB->result();
 
 		return $rows;
diff --git a/lib/packages/webdictionary/webdictionary.class.php b/lib/packages/webdictionary/webdictionary.class.php
index 50e98ffe..ba3ea7d4 100644
--- a/lib/packages/webdictionary/webdictionary.class.php
+++ b/lib/packages/webdictionary/webdictionary.class.php
@@ -24,12 +24,13 @@ class webdictionary
 
 		if(is_numeric($id))
 		{
 			if($DB->query('SELECT * FROM nv_webdictionary
 							WHERE node_id = '.intval($id).'
-							  AND node_type = '.protect('global').'
-							  AND website = '.$website->id))
+							  AND node_type = "global"
+							  AND website = '.intval($website->id))
+            )
 			{
 				$data = $DB->result();
 				$this->load_from_resultset($data); // there will be as many entries as languages enabled
 			}
 		}
@@ -65,20 +66,31 @@ class webdictionary
 				// node_id is not used in database with theme strings
 				$DB->query('
 					SELECT lang, text
 					  FROM nv_webdictionary 
 					 WHERE node_type = "extension"
-					   AND extension = '.protect($this->extension).'
-					   AND subtype = '.protect($this->subtype).'
-					   AND website = '.$website->id
+					   AND extension = :extension
+					   AND subtype = :subtype
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':subtype' => $this->subtype,
+                        ':extension' => $this->extension
+                    )
 				);
 
 				$data = $DB->result();
 
-				if(!is_array($data)) $data = array();
+				if(!is_array($data))
+				{
+				    $data = array();
+                }
 				foreach($data as $item)
-					$this->text[$item->lang] = $item->text;
+                {
+                    $this->text[$item->lang] = $item->text;
+                }
 			}
 			else    // theme translation (only for the current active theme)
 			{
 				$id = $path[2];
 
@@ -103,13 +115,19 @@ class webdictionary
 				// node_id is not used in database with theme strings
 				$DB->query('
 					SELECT lang, text
 					  FROM nv_webdictionary 
 					 WHERE node_type = "theme"
-					   AND theme = '.protect($theme->name).'
-					   AND subtype = '.protect($this->subtype).'
-					   AND website = '.$website->id
+					   AND theme = :theme 
+					   AND subtype = :subtype 
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':subtype' => $this->subtype,
+                        ':theme' => $theme->name
+                    )
 				);
 
 				$data = $DB->result();
 
 				if(!is_array($data)) $data = array();
@@ -161,24 +179,39 @@ class webdictionary
 		// remove all old entries
         $node_id_filter = '';
 
 		if(!empty($this->node_id))
 		{
+		    $query_params = array(
+                ':wid' => $this->website,
+                ':subtype' => $this->subtype,
+                ':theme' => $this->theme,
+                ':extension' => $this->extension,
+                ':node_type' => $this->node_type
+            );
+
 			if(is_numeric($this->node_id))
-				$node_id_filter .= ' AND node_id = '.intval($this->node_id);
+            {
+				$node_id_filter .= ' AND node_id = :node_id ';
+				$query_params[':node_id'] = $this->node_id;
+            }
 
 			if(is_numeric($this->node_uid))
-				$node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
+            {
+				$node_id_filter .= ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $this->node_uid;
+            }
 
 			$DB->execute('
 				DELETE FROM nv_webdictionary 
-					WHERE website = '.protect($this->website).'
-					  AND subtype = '.protect($this->subtype).'
-					  AND theme = '.protect($this->theme).' 
-					  AND extension = '.protect($this->extension).' 
-					  AND node_type = '.protect($this->node_type).
-					  $node_id_filter
+					WHERE website = :wid 
+					  AND subtype = :subtype
+					  AND theme = :theme  
+					  AND extension = :extension  
+					  AND node_type = :node_type
+					  '.$node_id_filter,
+                $query_params
 			);
 		}
 		
 		// insert the new ones
 		return $this->insert();			
@@ -186,29 +219,44 @@ class webdictionary
 	
 	public function delete()
 	{
 		global $DB;
 
-        $node_id_filter = "";
+        $node_filter = "";
 
 		// remove all old entries
 		if(!empty($this->node_id))
 		{
+		    $query_params = array(
+                ':wid' => $this->website,
+                ':extension' => $this->extension,
+                ':theme' => $this->theme,
+                ':node_type' => $this->node_type,
+                ':subtype' => $this->subtype
+            );
+
             if(is_numeric($this->node_id))
-                $node_id_filter .= ' AND node_id = '.intval($this->node_id);
+            {
+                $node_filter .= ' AND node_id = :node_id ';
+                $query_params[':node_id'] = $this->node_id;
+            }
 
             if(is_numeric($this->node_uid))
-                $node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
+            {
+                $node_filter .= ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $this->node_uid;
+            }
 			
 			$DB->execute('
  				DELETE FROM nv_webdictionary
-				WHERE subtype = '.protect($this->subtype).'
-				  AND node_type = '.protect($this->node_type).'
-				  AND theme = '.protect($this->theme).'
-				  AND extension = '.protect($this->extension).'
-				  AND website = '.protect($this->website).
-				  $node_id_filter
+				WHERE subtype = :subtype
+				  AND node_type = :node_type
+				  AND theme = :theme 
+				  AND extension = :extension 
+				  AND website = :wid
+				  '.$node_filter,
+                $query_params
 			);
 		}
 		
 		return $DB->get_affected_rows();		
 	}
@@ -225,13 +273,19 @@ class webdictionary
 		{
 			// we need to find what is the next node_id available for this subtype
 			$tmp = $DB->query_single(
 				'MAX(node_id)',
 				'nv_webdictionary',
-				' subtype = '.protect($this->subtype).'
-				       AND node_type = '.protect($this->node_type).'
-					   AND website = '.$this->website
+				' subtype = :subtype 
+				       AND node_type = :node_type 
+					   AND website = :wid',
+                null,
+                array(
+                    ':wid' => $this->website,
+                    ':subtype' => $this->subtype,
+                    ':node_type' => $this->node_type
+                )
 			);
 
 			$this->node_id = intval($tmp) + 1;
 		}
 
@@ -288,17 +342,32 @@ class webdictionary
 
 	// only for strings NOT from theme dictionary 
 	public static function load_object_strings($node_type, $node_id, $node_uid=null)
 	{
 		global $DB;
+
+		$query_params = array(
+            ':node_type' => $node_type,
+            ':node_id' => $node_id
+        );
+
+		$uid_filter = '';
+		if(!empty($node_uid))
+        {
+            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
+            $query_params[':node_uid'] = $node_uid;
+        }
+
 		
 		$DB->query('
 			SELECT subtype, lang, text
 			  FROM nv_webdictionary
-			 WHERE node_type = '.protect($node_type).'
-			   AND node_id = '.protect($node_id).
-            (empty($node_uid)? '' : ' AND ( node_uid = '.protect($node_uid).' OR node_uid = "" OR node_uid IS NULL )')
+			 WHERE node_type = :node_type
+			   AND node_id = :node_id 
+            '.$uid_filter,
+            'object',
+            $query_params
 		);
 
 		$data = $DB->result();
 
 		if(!is_array($data)) $data = array();
@@ -331,44 +400,64 @@ class webdictionary
             {
                 $subtypes = array_keys($texts);
 
                 $DB->execute('
                     DELETE FROM nv_webdictionary
-                     WHERE node_type = '.protect($node_type).'
-                       AND node_id = '.protect($node_id).'
-                       AND website = '.$website_id.'
-                       AND lang = '.protect($lang).'
-                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')'
+                     WHERE node_type = :node_type
+                       AND node_id = :node_id 
+                       AND website = :wid 
+                       AND lang = :lang
+                       AND subtype IN (:subtype)',
+                    array(
+                        ':wid' => $website_id,
+                        ':lang' => $lang,
+                        ':node_id' => $node_id,
+                        ':node_type' => $node_type,
+                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes))
+                    )
                 );
             }
         }
         else if($node_type=='property-block_group-extension-block')
         {
             // special case, remove only the rows we will insert
             foreach($dictionary as $lang => $texts)
             {
                 $subtypes = array_keys($texts);
 
-                $DB->execute('
-                    DELETE FROM nv_webdictionary
-                     WHERE node_type = '.protect($node_type).'
-                       AND node_id = '.protect($node_id).'
-                       AND website = '.$website_id.'
-                       AND lang = '.protect($lang).'
-                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')
-                       AND node_uid = '.protect($node_uid)
+                $DB->execute(
+                    'DELETE FROM nv_webdictionary
+                         WHERE node_type = :node_type
+                           AND node_id = :node_id 
+                           AND website = :wid 
+                           AND lang = :lang
+                           AND subtype IN (:subtype)
+                           AND node_uid = :node_uid',
+                    array(
+                        ':wid' => $website_id,
+                        ':lang' => $lang,
+                        ':node_id' => $node_id,
+                        ':node_type' => $node_type,
+                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes)),
+                        ':node_uid' => $node_uid
+                    )
                 );
             }
         }
         else
         {
             // first, delete old entries (deletes too much rows when updating block group block properties)
             $DB->execute('
                 DELETE FROM nv_webdictionary
-                 WHERE node_type = '.protect($node_type).'
-                   AND node_id = '.protect($node_id).'
-                   AND website = '.$website_id
+                 WHERE node_type = :node_type 
+                   AND node_id = :node_id 
+                   AND website = :wid',
+                array(
+                    ':wid' => $website_id,
+                    ':node_type' => $node_type,
+                    ':node_id' => $node_id
+                )
             );
             // and then insert the new values
         }
 
 		foreach($dictionary as $lang => $item)
@@ -420,44 +509,61 @@ class webdictionary
 
 			switch($type)
 			{
 				case "global":
 					// remove old entry, if exists
-					$DB->execute('
-		                DELETE FROM nv_webdictionary
-						WHERE node_id = '.protect($id).'
-						  AND node_type = '.protect('global').'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+					$DB->execute(
+                    'DELETE FROM nv_webdictionary
+						WHERE node_id = :id 
+						  AND node_type = "global"
+						  AND lang = :lang 
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $language,
+                            ':id' => $id
+                        )
+                    );
 					break;
 
 				case "theme":
 					// remove old entry, if exists
 					$DB->execute('
 		                DELETE FROM nv_webdictionary
-						WHERE subtype = '.protect($id).'
-						  AND node_type = '.protect("theme").'
-						  AND theme = '.protect($object).'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+						WHERE subtype = :id 
+						  AND node_type = "theme"
+						  AND theme = :object
+						  AND lang = :lang 
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $language,
+                            ':object' => $object,
+                            ':id' => $id
+                        )
+                    );
 					break;
 
 				case "extension":
 					// remove old entry, if exists
-					$DB->execute('
-		                DELETE FROM nv_webdictionary
-						WHERE subtype = '.protect($id).'
-						  AND node_type = '.protect("extension").'
-						  AND extension = '.protect($object).'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+					$DB->execute(
+                    'DELETE FROM nv_webdictionary
+						WHERE subtype = :id
+						  AND node_type = "extension"
+						  AND extension = :object 
+						  AND lang = :lang
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':id' => $id,
+                            ':object' => $object,
+                            ':lang' => $language,
+                            ':wid' => $website->id
+                        )
+                    );
 					break;
 			}
 
 			// insert new value (if not empty)
 			if(!empty($text))
@@ -493,11 +599,11 @@ class webdictionary
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/webdictionary/webdictionary_history.class.php b/lib/packages/webdictionary/webdictionary_history.class.php
index 50e5805f..10441b25 100644
--- a/lib/packages/webdictionary/webdictionary_history.class.php
+++ b/lib/packages/webdictionary/webdictionary_history.class.php
@@ -21,24 +21,36 @@ class webdictionary_history
 		{
 			foreach($item as $subtype => $litem)
 			{	
 				if(strpos($subtype, 'section-')===0)
 				{			
-					if($litem=='<p><br _mce_bogus="1"></p>') continue;	// tinymce empty contents, no need to save it
+					if($litem=='<p><br _mce_bogus="1"></p>')
+                    {
+                        // equals to tinymce empty content, so no need to save it
+                        continue;
+                    }
 				
-					// has the text been changed since last save?
+					// has the text been changed since the last save?
 					$last_litem = $DB->query_single(
 						'`text`',
 						'nv_webdictionary_history',
-						'   node_id = '.protect($node_id).' AND
-							website = '.protect($website_id).' AND
-							lang = '.protect($lang).' AND
-							subtype = '.protect($subtype).' AND
-							node_type = '.protect($node_type).' AND
-							autosave = '.protect(($autosave)? '1' : '0').'
-						 ORDER BY date_created DESC
-						'
+						'   
+						    node_id = :node_id AND
+							website = :wid AND
+							lang = :lang AND
+							subtype = :subtype AND
+							node_type = :node_type AND
+							autosave = '.(($autosave)? '1' : '0').'
+						 ORDER BY date_created DESC',
+                        null,
+                        array(
+                            ':wid' => $website_id,
+                            ':node_id' => $node_id,
+                            ':lang' => $lang,
+                            ':subtype' => $subtype,
+                            ':node_type' => $node_type
+                        )
 					);
 																							
 					if($last_litem != $litem)
 					{
                         $changed = true;
@@ -47,17 +59,24 @@ class webdictionary_history
 						if($autosave) 
 						{
 							// remove previous autosaved elements
 							$DB->execute('
 								DELETE FROM nv_webdictionary_history
-								WHERE node_id = '.protect($node_id).' AND
-									  website = '.protect($website_id).' AND
-										 lang = '.protect($lang).' AND
-									  subtype = '.protect($subtype).' AND
-									node_type = '.protect($node_type).' AND
+								WHERE node_id = :node_id AND
+									  website = :wid AND
+										 lang = :lang AND
+									  subtype = :subtype AND
+									node_type = :node_type AND
 									 autosave = 1 AND
-								 date_created < '.(core_time() - 86400 * 7)
+								 date_created < '.(core_time() - 86400 * 7),
+                                array(
+                                    ':wid' => $website_id,
+                                    ':lang' => $lang,
+                                    ':node_id' => $node_id,
+                                    ':node_type' => $node_type,
+                                    ':subtype' => $subtype
+                                )
 							);
 						}
 
 						$DB->execute('
 			                INSERT INTO nv_webdictionary_history
@@ -90,13 +109,18 @@ class webdictionary_history
 		
 		// load all webdictionary history elements and keep only the latest
 		$DB->query('
 			SELECT subtype, lang, text
 			  FROM nv_webdictionary_history
-			 WHERE node_type = '.protect($node_type).'
-			   AND node_id = '.protect($node_id).'
-			 ORDER BY date_created ASC'
+			 WHERE node_type = :node_type 
+			   AND node_id = :node_id
+			 ORDER BY date_created ASC',
+            'object',
+            array(
+                ':node_type' => $node_type,
+                ':node_id' => $node_id
+            )
 		);
 				
 		$data = $DB->result();
 		
 		if(!is_array($data)) $data = array();
@@ -117,11 +141,11 @@ class webdictionary_history
 
         $out = array();
 
         $DB->query('
 			SELECT * FROM nv_webdictionary_history
-			WHERE website = '.protect($website->id),
+			WHERE website = '.intval($website->id),
 	        'object'
         );
 
         if($type='json')
             $out = json_encode($DB->result());
diff --git a/lib/packages/websites/website.class.php b/lib/packages/websites/website.class.php
index 1c6cae8c..58f124e1 100644
--- a/lib/packages/websites/website.class.php
+++ b/lib/packages/websites/website.class.php
@@ -1264,11 +1264,11 @@ class website
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_websites WHERE id = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_websites WHERE id = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/websites/websites.php b/lib/packages/websites/websites.php
index 1737ea69..a46f1a46 100644
--- a/lib/packages/websites/websites.php
+++ b/lib/packages/websites/websites.php
@@ -29,24 +29,30 @@ function run()
                     }
 
 					$DB->query('
 						SELECT p.path, d.text
 						  FROM nv_paths p, nv_webdictionary d
-						 WHERE p.website = '.protect($website->id).' AND
-						       p.lang = '.protect($lang).' AND
+						 WHERE p.website = :website_id AND
+						       p.lang = :lang AND
 						       d.website = p.website AND
 						       d.node_type = p.type AND
 						       d.node_id = p.object_id AND
 						       d.lang = p.lang AND
 						       d.subtype = "title" AND 
 						       (    
-						            p.path LIKE '.protect('%'.$text.'%').'  OR  
-									d.text LIKE '.protect('%'.$text.'%').' 
+						            p.path LIKE :text  OR  
+									d.text LIKE :text 
 						       )
 						 ORDER BY d.id DESC
-						 LIMIT 10
-					');
+						 LIMIT 10',
+                        'object',
+                        array(
+					        ':website_id' => $website->id,
+                            ':lang' => $lang,
+                            ':text' => '%' . $text . '%'
+                        )
+                    );
 
 					$result = $DB->result();
 
 
 					echo json_encode($result);
@@ -208,17 +214,22 @@ function run()
 				}
 			}
 			break;
 
 		case 5:	// search an existing path
-			$DB->query('SELECT path as id, path as label, path as value
+			$DB->query(
+			    'SELECT path as id, path as label, path as value
 						  FROM nv_paths
-						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').'
-						   AND website = '.protect($_REQUEST['wid']).'
+						 WHERE path LIKE :term
+						   AND website = :website_id
 				      ORDER BY path ASC
 					     LIMIT 30',
-						'array');
+                'array',
+                array(
+                    ':website_id' => $_REQUEST['wid'],
+                    ':term' => '%'.$_REQUEST['term'].'%'
+                ));
 
 			echo json_encode($DB->result());
 
 			core_terminate();
 			break;
@@ -451,11 +462,11 @@ function websites_form($item)
 		    $DB->query('
 				SELECT text
 				  FROM nv_webdictionary
 				  WHERE node_type = "item"
 				    AND website = '.$item->id.'
-				    AND text LIKE '.protect("%navigate_download.php%").'
+				    AND text LIKE "%navigate_download.php%"
 			    LIMIT 1
 		    ');
 		    $rs = $DB->result('text');
 		    preg_match("/<img .*?(?=src)src=\"([^\"]+)\"/si", $rs[0], $old_url_guessed);
 		    $old_url_guessed = @$old_url_guessed[1];
@@ -1204,11 +1215,11 @@ function websites_form($item)
         )
     );
 
     // number format | thousands separator
     $data = array(
-        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
+        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
         1	=> json_decode('{"code": ",", "name": ", ---> 1,234,567"}'),
         2	=> json_decode('{"code": ".", "name": ". ---> 1.234.567"}'),
     );
 
     $select = $naviforms->select_from_object_array('website-thousands_separator', $data, 'code', 'name', $item->thousands_separator);
diff --git a/lib/packages/webuser_votes/webuser_vote.class.php b/lib/packages/webuser_votes/webuser_vote.class.php
index 6c2a8300..747c6e6e 100644
--- a/lib/packages/webuser_votes/webuser_vote.class.php
+++ b/lib/packages/webuser_votes/webuser_vote.class.php
@@ -127,16 +127,23 @@ class webuser_vote
 		global $website;
 		
 		$DB->query('
 			SELECT value, COUNT(*) as votes
 			  FROM nv_webuser_votes
-             WHERE website = '.protect($website->id).'
-			   AND object  = '.protect($object).'
-               AND object_id = '.protect($object_id).'
+             WHERE website = :wid
+			   AND object  = :object
+               AND object_id = :object_id
 			 GROUP BY value
 			 ORDER BY value ASC
-		 ');
+		 ',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            )
+        );
 					 
 		$data = $DB->result();
 		
 		return $data;
 	}
@@ -144,41 +151,56 @@ class webuser_vote
 	public static function object_votes_by_webuser($object, $object_id, $orderby='date desc', $offset=0, $limit=PHP_INT_MAX)
 	{
 		global $DB;
 		global $website;
 		
-		$DB->queryLimit('wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username', 
-						'nv_webuser_votes wuv, nv_webusers wu', 
-						'	 wuv.website = '.protect($website->id).'
-					   	 AND wuv.object  = '.protect($object).'
- 					   	 AND wuv.object_id = '.protect($object_id).'
-					   	 AND wu.id = wuv.webuser',
-						$orderby, 
-						$offset, 
-						$limit);
+		$DB->queryLimit(
+		    'wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username',
+			'nv_webuser_votes wuv, nv_webusers wu',
+			'	 
+			    wuv.website = :wid 
+			    AND wuv.object  = :object 
+ 				AND wuv.object_id = :object_id
+				AND wu.id = wuv.webuser',
+            $orderby,
+            $offset,
+            $limit,
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            )
+        );
 					 				 
 		return array($DB->result(), $DB->foundRows());
 	}	
 	
 	public static function object_votes_by_date($object, $object_id, $since=0)
 	{
 		global $DB;
 		global $website;
 		
-		$fromDate = 0;
+		$from_date = 0;
 		if($since > 0)	// last x days
-			$fromDate = time() - $since*24*60*60;
+			$from_date = time() - $since * 24*60*60;
 		
 		$DB->query('
 			SELECT date, value 
 			  FROM nv_webuser_votes
-             WHERE website = '.protect($website->id).'
-			   AND object  = '.protect($object).'
-               AND object_id = '.protect($object_id).' 
-			   AND date > '.$fromDate.'
-			 ORDER BY date ASC
-        ');
+             WHERE website = :wid
+			   AND object  = :object
+               AND object_id = :object_id 
+			   AND date > :from_date
+			 ORDER BY date ASC',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id,
+                ':from_date' => $from_date
+            )
+        );
 					 
 		$data = $DB->result();
 		
 		$votes = array();
 		
@@ -202,13 +224,19 @@ class webuser_vote
 		
 		// user has voted in the past?
 		if($DB->query('
 				SELECT *
 				  FROM nv_webuser_votes
-				 WHERE webuser = '.intval($webuser).'
-				   AND object  = '.protect($object).'
-				   AND object_id = '.protect($object_id)
+				 WHERE webuser = :webuser 
+				   AND object  = :object
+				   AND object_id = :object_id',
+        'object',
+                array(
+                    ':webuser' => $webuser,
+                    ':object' => $object,
+                    ':object_id' => $object_id
+                )
 			)
 		)
 		{
 			$data = $DB->result();
 			$data = $data[0];
@@ -218,13 +246,18 @@ class webuser_vote
 
 		if($voted && $replace) // update
 		{
 			$ok = $DB->execute('
  				UPDATE nv_webuser_votes
-				   SET `value`	=  '.protect($value).',
-						date 	=  '.protect(core_time()).'
-				 WHERE id = '.$webuser_vote_id
+				   SET `value`	=  :value,
+						date 	=  :time
+				 WHERE id = :wu_vote_id',
+                array(
+                    ':wu_vote_id' => $webuser_vote_id,
+                    ':time' => core_time(),
+                    ':value' => $value
+                )
 			);
 			
 			if(!$ok)
 				throw new Exception($DB->get_last_error());
 			else
@@ -282,28 +315,40 @@ class webuser_vote
 		if(empty($table[$object]))
 			return false;
 		
 		$DB->execute('
 			UPDATE '.$table[$object].' 
-			   SET votes = '.protect($votes).',
-			   	   score = '.protect($score).'
-			 WHERE id = '.protect($object_id)
+			   SET  votes = :votes, 
+			        score = :score
+			 WHERE id = :object_id',
+            array(
+                ':votes' => $votes,
+                ':score' => $score,
+                ':object_id' => $object_id
+            )
 		);
 		
 		return true;		
 	}
 	
 	public static function calculate_object_score($object, $object_id)
 	{
 		global $DB;
 		global $website;
 				
-		$DB->query('SELECT COUNT(*) as votes, SUM(value) as score
-					  FROM nv_webuser_votes
-					 WHERE object_id = '.protect($object_id).'
-					   AND object = '.protect($object).'
-					   AND website = '.$website->id);	
+		$DB->query(
+		    'SELECT COUNT(*) as votes, SUM(value) as score
+                  FROM nv_webuser_votes
+                 WHERE object_id = :object_id
+                   AND object = :object
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            ));
 					   
 		$data = $DB->first();
 		
 		return array($data->votes, $data->score);
 	}
@@ -353,11 +398,11 @@ class webuser_vote
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());
 
         return $out;
diff --git a/lib/packages/webusers/webuser.class.php b/lib/packages/webusers/webuser.class.php
index 0e84cd32..7607ee1b 100644
--- a/lib/packages/webusers/webuser.class.php
+++ b/lib/packages/webusers/webuser.class.php
@@ -47,13 +47,22 @@ class webuser
 	{
 		global $DB;
 		global $session;
         global $events;
 
-        $ok = $DB->query('SELECT * FROM nv_webusers WHERE cookie_hash = '.protect($hash));
+        $ok = $DB->query(
+            'SELECT * FROM nv_webusers WHERE cookie_hash = :hash',
+            'object',
+            array(
+                ':hash' => $hash
+            )
+        );
+
         if($ok)
+        {
             $data = $DB->result();
+        }
 
         if(!empty($data))
 		{
 			$this->load_from_resultset($data);
 
@@ -97,16 +106,22 @@ class webuser
 
         // the profile exists (connected to a social network)?
         $swuser = $DB->query_single(
             'webuser',
             'nv_webuser_profiles',
-            ' network = '.protect($network).' AND '.
-            ' network_user_id = '.protect($network_user_id)
+            ' network = :network AND network_user_id = :network_uid',
+            null,
+            array(
+                ':network' => $network,
+                ':network_uid' => $network_user_id
+            )
         );
 
         if(!empty($swuser))
+        {
             $this->load($swuser);
+        }
     }
 
     public function load_from_resultset($rs)
 	{
 		$main = $rs[0];	
@@ -430,23 +445,30 @@ class webuser
 				
 		$A1 = md5($username.':'.APP_REALM.':'.$password);
 
         $website_check = '';
 		if($website > 0)
-			$website_check = 'AND website  = '.protect($website);
-
-		if($DB->query('SELECT * 
-						 FROM nv_webusers 
-						WHERE ( access = 0 OR
-						 		(access = 2 AND 
-						 			(access_begin = 0 OR access_begin < '.time().') AND 
-						 			(access_end = 0 OR access_end > '.time().') 
-					            )
-					           )
-						  '.$website_check.'
-						  AND LOWER(username) = '.protect($username))
-		)
+			$website_check = 'AND website  = '.intval($website);
+
+		$ok = $DB->query(
+		    'SELECT * 
+                     FROM nv_webusers 
+                    WHERE ( access = 0 OR
+                            (access = 2 AND 
+                                (access_begin = 0 OR access_begin < '.time().') AND 
+                                (access_end = 0 OR access_end > '.time().') 
+                            )
+                           )
+                      '.$website_check.'
+                      AND LOWER(username) = :username',
+        'object',
+            array(
+                ':username' => $username
+            )
+        );
+
+		if($ok)
 		{		
 			$data = $DB->result();
 
 			if(!empty($data))
 			{
@@ -484,11 +506,16 @@ class webuser
         // only the first _created_ will be used
 
         $username = $DB->query_single(
             'username',
             'nv_webusers',
-            'website = '.intval($website).' AND email = '.protect($email)
+            'website = :wid AND email = :email',
+            null,
+            array(
+                ':wid' => $website,
+                ':email' => $email
+            )
         );
 
         if(empty($username))
             return false;
 
@@ -566,13 +593,18 @@ class webuser
         }
 
 		$DB->query('
 			SELECT id, activation_key
 			  FROM nv_webusers
-			 WHERE email = '.protect($email).'
-			   AND activation_key = '.protect($hash).'
-		');
+			 WHERE email = :email
+			   AND activation_key = :hash',
+            'object',
+            array(
+                ':email' => $email,
+                ':hash' => $hash
+            )
+        );
 		$rs = $DB->first();
 
 		if(!empty($rs->id))
 		{
 			$wu = new webuser();
@@ -609,13 +641,18 @@ class webuser
         }
 
 		$DB->query('
 			SELECT id, activation_key
 			  FROM nv_webusers
-			 WHERE email = '.protect($email).'
-			   AND activation_key = '.protect($hash).'
-		');
+			 WHERE email = :email
+			   AND activation_key = :hash',
+            'object',
+            array(
+                ':email' => $email,
+                ':hash' => $hash
+            )
+        );
 		$rs = $DB->first();
 
 		if(!empty($rs->id))
 		{
 			$wu = new webuser();
@@ -668,12 +705,17 @@ class webuser
 
         // the profile exists?
         $swuser = $DB->query_single(
             'webuser',
             'nv_webuser_profiles',
-            ' network = '.protect($network).' AND '.
-            ' network_user_id = '.protect($network_user_id)
+            ' network = :network AND '.
+            ' network_user_id = :network_uid',
+            null,
+            array(
+                ':network' => $network,
+                ':network_uid' => $network_user_id
+            )
         );
 
         // the webuser already exists or is logged in?
         $wuser = new webuser();
 
@@ -755,14 +797,21 @@ class webuser
 		// remove spaces and make username lowercase (only to compare case insensitive)
 		$username = trim($username);
 		$username = mb_strtolower($username);
 	
 		$data = NULL;
-		if($DB->query('SELECT COUNT(*) as total
-					   FROM nv_webusers 
-					   WHERE LOWER(username) = '.protect($username).'
-					   	 AND website = '.$website_id))
+		if($DB->query(
+		    'SELECT COUNT(*) as total
+                   FROM nv_webusers 
+                   WHERE LOWER(username) = :username
+                     AND website = :wid',
+                array(
+                    ':wid' => $website_id,
+                    ':username' => $username
+                )
+            )
+        )
 		{
 			$data = $DB->first();
 		}
 		
 		return ($data->total <= 0);
@@ -886,11 +935,11 @@ class webuser
         $DB->query('
             SELECT ex.id 
             FROM (  
                     SELECT id, activation_key, SUBSTRING_INDEX(activation_key, "-", -1) AS expiration_time
                     FROM nv_webusers
-                    WHERE website = ' . protect($website->id) . '
+                    WHERE website = ' . intval($website->id) . '
                       AND access = 1
                       AND activation_key != ""
                   ) ex
             WHERE ex.activation_key <> ex.expiration_time
               AND '.time().' > ex.expiration_time
@@ -924,11 +973,11 @@ class webuser
                 birthdate, language, country, timezone,
                 address, zipcode, location, phone, social_website,
                 joindate, lastseen, newsletter, private_comment, 
                 access, access_begin, access_end
             FROM nv_webusers
-            WHERE website = '.protect($website->id), 'array');
+            WHERE website = '.intval($website->id), 'array');
 
         $fields = array(
             "id",
             t(177, 'Website').' [NV]',
             t(1, 'User'),
@@ -987,18 +1036,18 @@ class webuser
         global $DB;
         global $website;
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webusers WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webusers WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_webusers'] = json_encode($DB->result());
 
         $DB->query('SELECT nwp.* FROM nv_webuser_profiles nwp, nv_webusers nw
                     WHERE nwp.webuser = nw.id
-                      AND nw.website = '.protect($website->id),
+                      AND nw.website = '.intval($website->id),
             'object');
 
         if($type='json')
             $out['nv_webuser_profiles'] = json_encode($DB->result());
 
diff --git a/lib/packages/webusers/webuser_group.class.php b/lib/packages/webusers/webuser_group.class.php
index b63c1c38..1ba3eb5d 100644
--- a/lib/packages/webusers/webuser_group.class.php
+++ b/lib/packages/webusers/webuser_group.class.php
@@ -111,11 +111,11 @@ class webuser_group
         global $DB;
         global $website;
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id));
+                    WHERE website = '.intval($website->id));
 
         return $DB->result();
     }
 
     public static function all_in_array()
@@ -124,11 +124,11 @@ class webuser_group
         global $website;
         $out = array();
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id));
+                    WHERE website = '.intval($website->id));
 
         $rs = $DB->result();
 
         foreach($rs as $row)
             $out[$row->id] = $row->name;
@@ -143,11 +143,11 @@ class webuser_group
 
         $out = array();
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id),
+                    WHERE website = '.intval($website->id),
                     'object');
 
         $out = $DB->result();
 
         return $out;
diff --git a/lib/webgets/blocks.php b/lib/webgets/blocks.php
index b90aefc3..f8560435 100644
--- a/lib/webgets/blocks.php
+++ b/lib/webgets/blocks.php
@@ -83,26 +83,37 @@ function nvweb_blocks($vars=array())
     }
 
 	switch($order_mode)
 	{
         case 'single':
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':id' => $vars['id']
+            );
+
             $query_type = '';
             if(!empty($vars['type']))
-                $query_type = ' AND type = '.protect($vars['type']);
+            {
+                $query_type = ' AND type = :type';
+                $query_params[':type'] = $vars['type'];
+            }
 
             $DB->query('
                 SELECT id, type
                   FROM nv_blocks
                  WHERE enabled = 1
                    '.$query_type.'
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    '.$categories_query.'
                    '.$exclusions_query.'
-                   AND id = '.protect($vars['id'])
+                   AND id = :id',
+                'object',
+                $query_params
             );
             $row = $DB->first();
 
             if(!empty($row))
             {
@@ -111,23 +122,31 @@ function nvweb_blocks($vars=array())
             }
             break;
 
         case 'priority':
 		case 'ordered':
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':type' => $vars['type']
+            );
+
             $DB->query('
                 SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    '.$categories_query.'
                    '.$exclusions_query.'
-                ORDER BY position ASC
-            ');
+                ORDER BY position ASC',
+                'object',
+                $query_params
+            );
 			$rows = $DB->result();
 
 			foreach($rows as $row)
 			{				
 				if(!nvweb_block_enabled($row)) continue;
@@ -139,46 +158,59 @@ function nvweb_blocks($vars=array())
 		default:			
 		case 'random':
             // "random" gets priority blocks first
             // retrieve fixed blocks
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':type' => $vars['type']
+            );
+
             $DB->query('
                 SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    AND fixed = 1
                    '.$categories_query.'
                    '.$exclusions_query.'
-              ORDER BY position ASC
-            ');
+              ORDER BY position ASC',
+                'object',
+                $query_params
+            );
 
 			$fixed_rows = $DB->result();
 			$fixed_rows_ids = $DB->result('id');
 
         	if(empty($fixed_rows_ids))
-        		$fixed_rows_ids = array(0);
+            {
+                $fixed_rows_ids = array(0);
+            }
+
+        	$query_params[':fr_ids'] = implode(",", $fixed_rows_ids);
 
             // now retrieve the other blocks in random order
 			$DB->query('
 			    SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
-                   AND id NOT IN('.implode(",", $fixed_rows_ids).')
+                   AND id NOT IN(:fr_ids)
                    '.$categories_query.'
                    '.$exclusions_query.'
-                 ORDER BY RAND()
-            ');
+                 ORDER BY RAND()',
+                $query_params
+            );
 		
 			$random_rows = $DB->result();
 
 			// mix rows (fixed and random)
 
diff --git a/lib/webgets/comments.php b/lib/webgets/comments.php
index b5dfebe3..0b2be467 100644
--- a/lib/webgets/comments.php
+++ b/lib/webgets/comments.php
@@ -629,18 +629,24 @@ function nvweb_comments_list($offset=0, $limit=NULL, $permission=NULL, $order='o
                        AND nvcr.status = 0
                    ) AS replies
               FROM nv_comments nvc
              LEFT OUTER JOIN nv_webusers nvwu
                           ON nvwu.id = nvc.user
-             WHERE nvc.website = '.protect($website->id).'
-               AND nvc.object_type = '.protect($object_type).'
-               AND nvc.object_id = '.protect($object_id).'
+             WHERE nvc.website = :wid 
+               AND nvc.object_type = :object_type
+               AND nvc.object_id = :object_id 
                AND nvc.status = 0
                AND nvc.reply_to = 0
             ORDER BY ' . $orderby . '
             LIMIT ' . $limit . '
-           OFFSET ' . $offset
+           OFFSET ' . $offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         $rs = $DB->result();
 
         $out = array();
@@ -671,17 +677,23 @@ function nvweb_comments_list($offset=0, $limit=NULL, $permission=NULL, $order='o
         $DB->query('
             SELECT SQL_CALC_FOUND_ROWS nvc.*, nvwu.username, nvwu.avatar
               FROM nv_comments nvc
              LEFT OUTER JOIN nv_webusers nvwu
                           ON nvwu.id = nvc.user
-             WHERE nvc.website = ' . protect($website->id) . '
-               AND nvc.object_type = '.protect($object_type).'
-               AND nvc.object_id = '.protect($object_id).'
+             WHERE nvc.website = :wid
+               AND nvc.object_type = :object_type
+               AND nvc.object_id = :object_id 
                AND nvc.status = 0
             ORDER BY ' . $orderby . '
             LIMIT ' . $limit . '
-           OFFSET ' . $offset
+           OFFSET ' . $offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         $rs = $DB->result();
         $total = $DB->foundRows();
     }
@@ -707,16 +719,21 @@ function nvweb_website_comments_list($offset=0, $limit=2147483647, $permission=N
 				 LEFT OUTER JOIN nv_webdictionary nvwd
 				              ON nvwd.node_id = nvc.object_id AND
                                  nvwd.website = nvc.website AND
                                  nvwd.node_type = nvc.object_type AND
                                  nvwd.subtype = "title" AND
-                                 nvwd.lang = '.protect($current['lang']).'
-				 WHERE nvc.website = '.protect($website->id).'
+                                 nvwd.lang = :lang
+				 WHERE nvc.website = :wid
 				   AND status = 0
 				ORDER BY '.$orderby.'
 				LIMIT '.$limit.'
-			   OFFSET '.$offset);
+			   OFFSET '.$offset,
+        array(
+            ':wid' => $website->id,
+            ':lang' => $current['lang']
+        )
+    );
 
     $rs = $DB->result();
     $total = $DB->foundRows();
 
     return array($rs, $total);
diff --git a/lib/webgets/conditional.php b/lib/webgets/conditional.php
index e338c30c..b0845aec 100644
--- a/lib/webgets/conditional.php
+++ b/lib/webgets/conditional.php
@@ -101,29 +101,36 @@ function nvweb_conditional($vars=array())
             $DB->query('
                 SELECT SQL_CALC_FOUND_ROWS i.id, i.permission, i.date_published, i.date_unpublish,
                        i.date_to_display, COALESCE(NULLIF(i.date_to_display, 0), i.date_created) as pdate,
                        d.text as title, i.position as position
                   FROM nv_items i, nv_structure s, nv_webdictionary d
-                 WHERE i.category IN('.implode(",", $categories).')
-                   AND i.website = '.$website->id.'
+                 WHERE i.category IN(:categories)
+                   AND i.website = :wid
                    AND i.permission <= '.$permission.'
-                   AND (i.date_published = 0 OR i.date_published < '.core_time().')
-                   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+                   AND (i.date_published = 0 OR i.date_published < :time)
+                   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                    AND s.id = i.category
-                   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-                   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+                   AND (s.date_published = 0 OR s.date_published < :time)
+                   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                    AND s.permission <= '.$permission.'
                    AND (s.access = 0 OR s.access = '.$access.$access_extra.')
                    AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
                    AND d.website = i.website
                    AND d.node_type = "item"
                    AND d.subtype = "title"
                    AND d.node_id = i.id
-                   AND d.lang = '.protect($current['lang']).'
+                   AND d.lang = :lang
                  '.$orderby.'
                  LIMIT 1
-                 OFFSET 0'
+                 OFFSET 0',
+            'object',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $current['lang'],
+                    ':categories' => implode(",", $categories),
+                    ':time' => core_time()
+                )
             );
 
             $rs = $DB->result();
 
             // now we have the element against which the condition will be checked
@@ -438,15 +445,20 @@ function nvweb_conditional($vars=array())
 
         case 'comments':
             $DB->query('
                 SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
-				   AND object_id = '.protect($item->id).'
+				 WHERE website = :wid
+				   AND object_id = :item_id
 				   AND object_type = "item"
-				   AND status = 0
-            ');
+				   AND status = 0',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':item_id' => $item->id
+                )
+            );
             $rs = $DB->result();
             $comments_count = intval($rs[0]->total) + 0;
 
             if(isset($vars['allowed']))
             {
diff --git a/lib/webgets/contact.php b/lib/webgets/contact.php
index 07ef9b7a..f2bf3010 100644
--- a/lib/webgets/contact.php
+++ b/lib/webgets/contact.php
@@ -287,13 +287,13 @@ function nvweb_contact_generate($fields)
     // default colors
     $background_color = '#E5F1FF';
     $text_color = '#595959';
     $title_color = '#595959';
 
-    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.background_color").' AND website = '.protect($website->id), 'id DESC');
-    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.text_color").' AND website = '.protect($website->id), 'id DESC');
-    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.titles_color").' AND website = '.protect($website->id), 'id DESC');
+    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.background_color" AND website = '.intval($website->id), 'id DESC');
+    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.text_color" AND website = '.intval($website->id), 'id DESC');
+    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.titles_color" AND website = '.intval($website->id), 'id DESC');
 
     if(!empty($background_color_db))    $background_color = str_replace('"', '', $background_color_db);
     if(!empty($text_color_db))          $text_color = str_replace('"', '', $text_color_db);
     if(!empty($title_color_db))         $title_color = str_replace('"', '', $title_color_db);
 
diff --git a/lib/webgets/content.php b/lib/webgets/content.php
index 0f84bd58..e1ed69a3 100644
--- a/lib/webgets/content.php
+++ b/lib/webgets/content.php
@@ -315,13 +315,13 @@ function nvweb_content_comments_count($object_id = NULL, $object_type = "item")
 	if(empty($object_id))
 		$object_id = $element->id;
 
 	$DB->query('SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
+				 WHERE website = '.intval($website->id).'
 				   AND object_type = "'.$object_type.'"
-				   AND object_id = '.protect($object_id).'
+				   AND object_id = '.intval($object_id).'
 				   AND status = 0'
 				);
 													
 	$out = $DB->result('total');
 	
@@ -416,14 +416,18 @@ function nvweb_content_items($categories=array(), $only_published=false, $max=NU
          LEFT JOIN nv_webdictionary d ON
          	   d.website = i.website
 			   AND d.node_type = "item"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
         WHERE '.$where.'
         '.$orderby.'
-        '.$limit
+        '.$limit,
+        'object',
+        array(
+            ':lang' => $current['lang']
+        )
     );
 
     $rs = $DB->result();
 
     return $rs;
diff --git a/lib/webgets/gallery.php b/lib/webgets/gallery.php
index 3ee9a351..745140b2 100644
--- a/lib/webgets/gallery.php
+++ b/lib/webgets/gallery.php
@@ -68,12 +68,12 @@ function nvweb_gallery($vars=array())
 	else if($current['type']=='structure')
 	{
 		$DB->query('
 		    SELECT id, permission, date_published, date_unpublish
               FROM nv_items
-             WHERE category = '.protect($current['object']->id).'
-               AND website = '.$website->id.'
+             WHERE category = '.intval($current['object']->id).'
+               AND website = '.intval($website->id).'
         ');
 		$rs = $DB->first();
 		$enabled = nvweb_object_enabled($rs);
 
 		if($enabled || (($_REQUEST['preview']=='true' && $current['navigate_session']==1)))
diff --git a/lib/webgets/list.php b/lib/webgets/list.php
index 72f4efaa..ee2b2cb0 100644
--- a/lib/webgets/list.php
+++ b/lib/webgets/list.php
@@ -246,18 +246,18 @@ function nvweb_list($vars=array())
                 $search[] = '(
                                 '.$object_alias.'.id NOT IN (
                                     SELECT search_nwdi.node_id
                                     FROM nv_webdictionary search_nwdi
                                     WHERE search_nwdi.node_type IN ("'.$object_type.'", "property-'.$object_type.'") AND
-                                          search_nwdi.website = ' . protect($website->id) . ' AND
+                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                           search_nwdi.text LIKE ' . protect('%' . substr($what, 1) . '%') .
                             '    ) 
                                  AND '.$object_alias.'.id NOT IN( 
                                     SELECT search_npi.node_id
                                      FROM   nv_properties_items search_npi 
                                      WHERE  search_npi.element = "'.$object_type.'" AND 
-                                            search_npi.website = ' . protect($website->id) . ' AND
+                                            search_npi.website = ' . intval($website->id) . ' AND
                                             search_npi.value LIKE ' . protect('%' . substr($what, 1) . '%') . '
                                  )
                             )';
             }
             else
@@ -265,18 +265,18 @@ function nvweb_list($vars=array())
                 $search[] = '(
                                 '.$object_alias.'.id IN (
                                     SELECT search_nwdi.node_id
                                     FROM nv_webdictionary search_nwdi
                                     WHERE search_nwdi.node_type IN ("'.$object_type.'", "property-'.$object_type.'") AND
-                                          search_nwdi.website = ' . protect($website->id) . ' AND
+                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                           search_nwdi.text LIKE ' . protect('%' . $what . '%') .
                             '    )
                                  OR '.$object_alias.'.id IN( 
                                     SELECT  search_npi.node_id
                                      FROM   nv_properties_items search_npi
                                      WHERE  search_npi.element = "'.$object_type.'" AND 
-                                            search_npi.website = ' . protect($website->id) . ' AND
+                                            search_npi.website = ' . intval($website->id) . ' AND
                                             search_npi.value LIKE ' . protect('%' . $what . '%') . '
                                 )
                             )';
             }
         }
@@ -352,27 +352,34 @@ function nvweb_list($vars=array())
 		$DB->query('
 			SELECT SQL_CALC_FOUND_ROWS s.id, s.permission,
 			            s.date_published, s.date_unpublish, s.date_published as pdate,
 			            d.text as title, s.position as position
 			  FROM nv_structure s, nv_webdictionary d
-			 WHERE s.id IN('.implode(",", $categories).')
-			   AND s.website = '.$website->id.'
+			 WHERE s.id IN(:categories)
+			   AND s.website = :wid
 			   AND s.permission <= '.$permission.'
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND d.website = s.website
 			   AND d.node_type = "structure"
 			   AND d.subtype = "title"
 			   AND d.node_id = s.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
 		     '.$templates.'
 			 '.$visible.'
 			 '.$exclude.'
 			 '.$orderby.'
 			 LIMIT '.$vars['items'].'
-			OFFSET '.$offset
+			OFFSET '.$offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
 		);
 
 		$rs = $DB->result();
 		$total = $DB->foundRows();
 	}
@@ -572,35 +579,44 @@ function nvweb_list($vars=array())
         $query = '
 			SELECT SQL_CALC_FOUND_ROWS p.id, p.permission, p.date_published, p.date_unpublish,
                     p.date_to_display, COALESCE(NULLIF(p.date_to_display, 0), p.date_created) as pdate,
                     d.text as title, p.position as position, s.position '.$columns_extra.'
 			  FROM nv_products p, nv_structure s, nv_webdictionary d			          
-			 WHERE p.category IN('.implode(",", $categories).')
-			   AND p.website = '.$website->id.'
+			 WHERE p.category IN(:categories)
+			   AND p.website = :wid
 			   AND p.permission <= '.$permission.'
 			   AND (p.date_published = 0 OR p.date_published < '.core_time().')
 			   AND (p.date_unpublish = 0 OR p.date_unpublish > '.core_time().')
 			   AND s.id = p.category
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND s.permission <= '.$permission.'
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND (p.access = 0 OR p.access = '.$access.$access_extra_items.')
                AND d.website = p.website
 			   AND d.node_type = "product"
 			   AND d.subtype = "title"
 			   AND d.node_id = p.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
              '.$filters.'
              '.$search.'
 		     '.$templates.'
 			 '.$exclude.'
 			 '.$orderby.'
 			 LIMIT '.$vars['items'].'
 			OFFSET '.$offset;
 
-        $DB->query($query);
+        $DB->query(
+            $query,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
+        );
 
         $rs = $DB->result();
         $total = $DB->foundRows();
     }
     else if($vars['source']=='cart')
@@ -644,31 +660,37 @@ function nvweb_list($vars=array())
 
                 // default source for retrieving items (embedded or not)
                 $DB->query('
                     SELECT SQL_CALC_FOUND_ROWS i.id
                       FROM nv_items i, nv_structure s, nv_webdictionary d
-                     WHERE i.category IN('.implode(",", $categories).')
-                       AND i.website = '.$website->id.'
+                     WHERE i.category IN(:categories)
+                       AND i.website = :wid
                        AND i.permission <= '.$permission.'
-                       AND (i.date_published = 0 OR i.date_published < '.core_time().')
-                       AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+                       AND (i.date_published = 0 OR i.date_published < :time)
+                       AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                        AND s.id = i.category
-                       AND (s.date_published = 0 OR s.date_published < '.core_time().')
-                       AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+                       AND (s.date_published = 0 OR s.date_published < :time)
+                       AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                        AND s.permission <= '.$permission.'
                        AND (s.access = 0 OR s.access = '.$access.$access_extra.')
                        AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
                        AND d.website = i.website
                        AND d.node_type = "item"
                        AND d.subtype = "title"
                        AND d.node_id = i.id
-                       AND d.lang = '.protect($current['lang']).'                       
+                       AND d.lang = :lang                       
                      '.$templates.'
                      '.$exclude.'
                      ORDER BY i.position ASC
-                     LIMIT 1
-                ');
+                     LIMIT 1',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $current['lang'],
+                        ':time' => core_time(),
+                        ':categories' => implode(",", $categories)
+                    ));
 
                 $rs = $DB->result();
                 $tmp = new item();
                 $tmp->load($rs[0]->id);
 
@@ -756,11 +778,11 @@ function nvweb_list($vars=array())
         //  c) Date unpublish is set and the value is before the current time (no more published)
         //  d) User account level not allowed [0=>everyone, 1=>signed in users, 2=>users NOT signed in]
         $DB->query('
             SELECT id
               FROM nv_structure
-             WHERE website = '.protect($website->id).'
+             WHERE website = '.intval($website->id).'
                AND (    permission > '.$permission.'
                      OR (date_published > 0 AND '.$website->current_time().' > date_published)
                      OR (date_unpublish > 0 AND '.$website->current_time().' > date_unpublish)
                      OR (access <> 0 AND access <> '.$access.')
                )
@@ -812,36 +834,45 @@ function nvweb_list($vars=array())
         $query = '
 			SELECT SQL_CALC_FOUND_ROWS i.id, i.permission, i.date_published, i.date_unpublish,
                     i.date_to_display, COALESCE(NULLIF(i.date_to_display, 0), i.date_created) as pdate,
                     d.text as title, i.position as position, s.position '.$columns_extra.'
 			  FROM nv_items i, nv_structure s, nv_webdictionary d			          
-			 WHERE i.category IN('.implode(",", $categories).')
-			   AND i.website = '.$website->id.'
+			 WHERE i.category IN(:categories)
+			   AND i.website = :wid
 			   AND i.permission <= '.$permission.'
 			   AND i.embedding = '.$embedded.'
-			   AND (i.date_published = 0 OR i.date_published < '.core_time().')
-			   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+			   AND (i.date_published = 0 OR i.date_published < :time)
+			   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
 			   AND s.id = i.category
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND s.permission <= '.$permission.'
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
                AND d.website = i.website
 			   AND d.node_type = "item"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
              '.$filters.'
              '.$search.'
 		     '.$templates.'
 			 '.$exclude.'
 			 '.$orderby.'
 			 LIMIT '.$vars['items'].'
 			OFFSET '.$offset;
 
-		$DB->query($query);
+		$DB->query(
+		    $query,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
+        );
 
 		$rs = $DB->result();
 
 		$total = $DB->foundRows();
 	}
@@ -862,12 +893,17 @@ function nvweb_list($vars=array())
     $item_html_preprocessed = $item_html;
     $nested_lists_fragments_preprocessed = $nested_lists_fragments;
     $nested_conditional_fragments_preprocessed = $nested_conditional_fragments;
     $conditional_placeholder_tags_preprocessed = nvweb_tags_extract($item_html, 'nvlist_conditional_placeholder', true, true, 'UTF-8'); // selfclosing = true
 
-    // now we have all elements that will be shown in the list
+    // now we have all elements that will be shown in the list (if any)
     // let's process the nvlist template for each one
+    if(empty($rs))
+    {
+        $rs = array();
+    }
+
 	for($i = 0; $i < count($rs); $i++)
 	{
         // ignore empty objects, except in custom_source or cart modes
         if( (!isset($vars['custom_source']) || $vars['custom_source']!='true') )
         {
@@ -1207,17 +1243,17 @@ function nvweb_list_parse_tag($tag, $item, $source='item', $item_relative_positi
                     }
 
                     $out = $DB->query_single(
                         'COUNT(id)',
                         'nv_items',
-                        ' category = '.protect($item->id).' AND
-                          website = '.protect($item->website).' AND
+                        ' category = '.intval($item->id).' AND
+                          website = '.intval($item->website).' AND
                           permission <= '.$permission.' AND 
                           (date_published = 0 OR date_published < '.core_time().') AND 
                           (date_unpublish = 0 OR date_unpublish > '.core_time().') AND 
                           (access = 0 OR access = '.$access.$access_extra.')
-                        ');
+                    ');
                     break;
 
 				default:
 					break;
 			}
@@ -1276,13 +1312,15 @@ function nvweb_list_parse_tag($tag, $item, $source='item', $item_relative_positi
 	                    {
 		                    $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
 	                    }
 	                    else if(!empty($item->user))
 	                    {
-		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.protect($item->user));
+		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.intval($item->user));
 		                    if(!empty($email))
-			                    $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
+                            {
+                                $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
+                            }
 	                    }
 
 	                    if(!empty($gravatar_hash) && $gravatar_default != 'none')
 	                    {
 		                    // gravatar real url: https://www.gravatar.com/avatar/
diff --git a/lib/webgets/liveedit.php b/lib/webgets/liveedit.php
index c06ec438..b04c0f25 100644
--- a/lib/webgets/liveedit.php
+++ b/lib/webgets/liveedit.php
@@ -37,13 +37,13 @@ function nvweb_liveedit_render($vars)
 
         case 'structure':
             // load the first item
             $DB->query('	SELECT id 
 								  FROM nv_items
-								 WHERE category = '.protect($current['category']).'
+								 WHERE category = '.intval($current['category']).'
 								   AND permission < 2
-								   AND website = '.$website->id.'
+								   AND website = '.intval($website->id).'
 						   ');
 
             $rs = $DB->first();
 
             $url = NAVIGATE_URL.'/'.NAVIGATE_MAIN.'?fid=items&act=edit&id='.$rs->id.'&tab=2&quickedit=true&wid='.$website->id;
diff --git a/lib/webgets/menu.php b/lib/webgets/menu.php
index d4ad13ad..313eae5a 100644
--- a/lib/webgets/menu.php
+++ b/lib/webgets/menu.php
@@ -61,11 +61,11 @@ function nvweb_menu($vars=array())
         }
 
         // get category parents until root (to know how many levels count from)
         while($last > 0)
         {
-            $last = $DB->query_single('parent', 'nv_structure', ' id = '.protect($last));
+            $last = $DB->query_single('parent', 'nv_structure', ' id = '.intval($last));
             $inverse_hierarchy[] = $last;
         }
         $current['hierarchy'] = array_reverse($inverse_hierarchy);
     }
 
@@ -390,16 +390,23 @@ function nvweb_menu_load_dictionary()
 			
 	if(empty($structure['dictionary']))
 	{
 		$structure['dictionary'] = array();
 
-		$DB->query('SELECT node_id, text
-					  FROM nv_webdictionary 
-					 WHERE node_type = "structure"
-					   AND subtype = "title" 
-					   AND lang = '.protect($current['lang']).'
-					   AND website = '.$website->id);		
+		$DB->query(
+		    'SELECT node_id, text
+                  FROM nv_webdictionary 
+                 WHERE node_type = "structure"
+                   AND subtype = "title" 
+                   AND lang = :lang
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
+        );
 					
 		$data = $DB->result();
 		
 		if(!is_array($data)) $data = array();
 		$dictionary = array();
@@ -420,15 +427,22 @@ function nvweb_menu_load_routes()
 			
 	if(empty($structure['routes']))
 	{
 		$structure['routes'] = array();
 
-		$DB->query('SELECT object_id, path
-					  FROM nv_paths 
-					 WHERE type = "structure"
-					   AND lang = '.protect($current['lang']).'
-					   AND website = '.$website->id);		
+		$DB->query(
+		    'SELECT object_id, path
+                  FROM nv_paths 
+                 WHERE type = "structure"
+                   AND lang = :lang
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
+        );
 					
 		$data = $DB->result();
 		
 		if(!is_array($data)) $data = array();
 		$dictionary = array();
@@ -453,13 +467,18 @@ function nvweb_menu_load_actions()
 
 		$DB->query('
             SELECT node_id, subtype, text
 			  FROM nv_webdictionary 
 			 WHERE node_type = "structure"
-			   AND lang = '.protect($current['lang']).'
+			   AND lang = :lang
 			   AND subtype IN("action-type", "action-jump-item", "action-jump-branch", "action-new-window")
-			   AND website = '.$website->id
+			   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
         );
 					
 		$data = $DB->result();
 		
 		if(!is_array($data))
@@ -480,15 +499,17 @@ function nvweb_menu_load_structure($parent=0)
 
 	if(!isset($structure['cat-'.$parent]))
 	{
 		$structure['cat-'.$parent] = array();
 		
-		$DB->query('SELECT * 
-					  FROM nv_structure
-					 WHERE parent = '.protect($parent).' 
-					   AND website = '.$website->id.' 
-					  ORDER BY position ASC');
+		$DB->query(
+		    'SELECT * 
+                  FROM nv_structure
+                 WHERE parent = '.intval($parent).' 
+                   AND website = '.intval($website->id).' 
+                  ORDER BY position ASC'
+        );
 				  
 		$structure['cat-'.$parent] = $DB->result();
 
         // parse some result values
         foreach($structure['cat-'.$parent] as $key => $value)
diff --git a/lib/webgets/metatags.php b/lib/webgets/metatags.php
index 2f119930..b18cad4d 100644
--- a/lib/webgets/metatags.php
+++ b/lib/webgets/metatags.php
@@ -22,15 +22,22 @@ function nvweb_metatags($vars=array())
 	{
 		case 'item':
             $section = 	$DB->query_single(
                 'text',
                 'nv_webdictionary',
-                ' node_type = '.protect($current['type']).' AND
-				    node_id = '.protect($current['object']->id).' AND
-					subtype = '.protect('title').' AND
-					website = '.$website->id.' AND
-					   lang = '.protect($current['lang'])
+                ' node_type = :type AND
+				    node_id = :object_id AND
+					subtype = "title" AND
+					website = :wid AND
+					   lang = :lang',
+                null,
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $current['lang'],
+                    ':object_id' => $current['object']->id,
+                    ':type' => $current['type']
+                )
             );
             array_push($page_title_parts, $section);
             break;
 
 		case 'structure':
diff --git a/lib/webgets/product.php b/lib/webgets/product.php
index f3e30aed..d57858b9 100644
--- a/lib/webgets/product.php
+++ b/lib/webgets/product.php
@@ -366,13 +366,13 @@ function nvweb_product_comments_count($object_id = NULL)
 	if(empty($object_id))
         $object_id = $current['object']->id;
 
 	$DB->query('SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
+				 WHERE website = '.intval($website->id).'
 				   AND object_type = "product"
-				   AND object_id = '.protect($object_id).'
+				   AND object_id = '.intval($object_id).'
 				   AND status = 0'
 				);
 													
 	$out = $DB->result('total');
 	
@@ -437,14 +437,18 @@ function nvweb_categories_products($categories=array(), $only_published=false, $
          LEFT JOIN nv_webdictionary d ON
          	   d.website = i.website
 			   AND d.node_type = "product"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
         WHERE '.$where.'
         '.$orderby.'
-        '.$limit
+        '.$limit,
+        'object',
+        array(
+            ':lang' => $current['lang']
+        )
     );
 
     $rs = $DB->result();
 
     return $rs;
diff --git a/lib/webgets/properties.php b/lib/webgets/properties.php
index 5a9ef5b6..f7c2e27f 100644
--- a/lib/webgets/properties.php
+++ b/lib/webgets/properties.php
@@ -47,11 +47,11 @@ function nvweb_properties($vars=array())
 
             if(!isset($properties['item-'.$vars['id']]) && !empty($vars['id']))
 			{
 				// load item template
 				if(empty($vars['template']))
-					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.protect($vars['id']));
+					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.intval($vars['id']));
 
                 // if template is not defined (embedded element), take its category template
                 if(empty($vars['template']))
                     $vars['template'] = $DB->query_single(
                         'template',
@@ -107,11 +107,11 @@ function nvweb_properties($vars=array())
 			if(!isset($properties['block-'.$vars['id']]))
 			{
 				// load item type
 				if(empty($vars['type']))
                 {
-                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.protect($vars['id']));
+                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.intval($vars['id']));
 
                     if(empty($cache['block_types']))
                         $cache['block_types'] = block::types();
 
                     // we need to know if the block is defined in the active theme or in the database (numeric ID)
@@ -189,11 +189,11 @@ function nvweb_properties($vars=array())
 			}
 						
 			if(!isset($properties['structure-'.$vars['id']]))	
 			{
 				// load category template
-				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.protect($vars['id']));
+				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.intval($vars['id']));
 				if(!empty($category_template))
 				{
 					$properties['structure-'.$vars['id']] = property::load_properties("structure", $category_template, 'structure', $vars['id']);
 				}
 			}
@@ -576,11 +576,11 @@ function nvweb_properties_render($property, $vars)
 			break;
 			
 		case 'file':
             if(!empty($property->value))
             {
-			    $file = $DB->query_single('name', 'nv_files', ' id = '.protect($property->value).' AND website = '.$website->id);
+			    $file = $DB->query_single('name', 'nv_files', ' id = '.intval($property->value).' AND website = '.intval($website->id));
 
                 if($vars['return']=='url' || $vars['return']=='url-download')
                     $out = NVWEB_OBJECT.'?type=file&id='.$property->value.'&disposition=attachment';
                 else if($vars['return']=='url-inline')
                     $out = NVWEB_OBJECT.'?type=file&id='.$property->value.'&disposition=inline';
diff --git a/lib/webgets/search.php b/lib/webgets/search.php
index 9fb93bf5..ae153a39 100644
--- a/lib/webgets/search.php
+++ b/lib/webgets/search.php
@@ -76,22 +76,22 @@ function nvweb_search($vars=array())
                 $likes[] = 'd.text NOT LIKE '.protect('%'.substr($what, 1).'%').
                             '    AND i.id NOT IN( 
                                             SELECT p.node_id
                                              FROM   nv_properties_items p 
                                              WHERE  p.element = "item" AND 
-                                                    p.website = '.protect($website->id).' AND
+                                                    p.website = '.intval($website->id).' AND
                                                     p.value LIKE '.protect('%'.substr($what, 1).'%').'
                                         )';
             }
             else
             {
 			    $likes[] = 'd.text LIKE '.protect('%'.$what.'%').
 			               '    OR i.id IN( 
 			                        SELECT  p.node_id
 			                         FROM   nv_properties_items p 
 			                         WHERE  p.element = "item" AND 
-			                                p.website = '.protect($website->id).' AND
+			                                p.website = '.intval($website->id).' AND
 			                                p.value LIKE '.protect('%'.$what.'%').'
                                 )';
             }
         }
 
@@ -268,17 +268,17 @@ function nvweb_search($vars=array())
                   FROM nv_items i, nv_webdictionary d
                   LEFT JOIN nv_webdictionary wd
                     ON wd.node_id = d.node_id
                    AND wd.lang =  ' . protect($current['lang']) . '
                    AND wd.node_type = "item"
-                   AND wd.website = ' . protect($website->id) . '			  
+                   AND wd.website = ' . intval($website->id) . '			  
                  WHERE i.website = ' . $website->id . '
                    AND i.permission <= ' . $permission . '
                    AND (i.date_published = 0 OR i.date_published < ' . core_time() . ')
                    AND (i.date_unpublish = 0 OR i.date_unpublish > ' . core_time() . ')
                    AND (i.access = 0 OR i.access = ' . $access . ')
-                   AND d.website = ' . protect($website->id) . '
+                   AND d.website = ' . intval($website->id) . '
                    AND d.node_id = i.id
                    AND d.lang =  ' . protect($current['lang']) . '
                    AND (d.node_type = "item" OR d.node_type = "tags")
                    AND (
                     ' . implode(' AND ', $likes) . '
diff --git a/lib/webgets/tags.php b/lib/webgets/tags.php
index 360b77a5..a45275cf 100644
--- a/lib/webgets/tags.php
+++ b/lib/webgets/tags.php
@@ -81,23 +81,33 @@ function nvweb_tags_retrieve($maxtags="", $categories=array(), $order='top', $se
                 ( node_type = "item" AND node_id IN('.implode(',', $categories).') )
             )
         ';
     }
 
+    $query_params = array(
+        ':wid' => $website->id,
+        ':lang' => $lang,
+        ':types' => implode(',', $types)
+    );
+
     if(!empty($search))
-        $extra.= ' AND text LIKE '.protect('%'.$search.'%'); // note: we will need to pass another filter after exploding the tags
+    {
+        $extra .= ' AND text LIKE :search'; // note: we will need to pass another filter after exploding the tags
+        $query_params[':search'] = '%' . $search . '%';
+    }
 
     $DB->query(
         'SELECT text FROM nv_webdictionary
-          WHERE website = '.$website->id.'
-            AND node_type IN("'.implode('","', $types).'")
+          WHERE website = :wid
+            AND node_type IN(:types)
             AND subtype = "tags"
-            AND lang = '.protect($lang).'
+            AND lang = :lang 
             '.$extra.'
           ORDER BY RAND()
         ',
-        'array'
+        'array',
+        $query_params
     );
 
     $rows = $DB->result();
 
     if(!empty($rows))
diff --git a/lib/webgets/votes.php b/lib/webgets/votes.php
index 82cd93b6..90559786 100644
--- a/lib/webgets/votes.php
+++ b/lib/webgets/votes.php
@@ -21,14 +21,21 @@ function nvweb_votes($vars=array())
 			if(!empty($webuser->id))
             {
 				$score = $DB->query_single(
                     'value',
                     'nv_webuser_votes',
-                    ' website = '.protect($website->id).'
-					  AND webuser = '.protect($webuser->id).'
-					  AND object = '.protect($current['type']).'
-					  AND object_id = '.protect($current['id'])
+                    ' website = :wid
+					  AND webuser = :webuser_id
+					  AND object = :type
+					  AND object_id = :object_id',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':webuser_id' => $webuser->id,
+                        ':type' => $current['type'],
+                        ':object_id' => $current['id']
+                    )
                 );
             }
 			$out = (empty($score)? '0' : $score);
 			break;
 	}
diff --git a/lib/webgets/webuser.php b/lib/webgets/webuser.php
index e3bdc849..a939b800 100644
--- a/lib/webgets/webuser.php
+++ b/lib/webgets/webuser.php
@@ -192,12 +192,17 @@ function nvweb_webuser($vars=array())
                 if(filter_var($email, FILTER_VALIDATE_EMAIL)!==FALSE)
                 {
                     $wu_id = $DB->query_single(
                         'id',
                         'nv_webusers',
-                        ' email = '.protect($email).'
-                          AND website = '.$website->id
+                        ' email = :email
+                          AND website = :wid',
+                        null,
+                        array(
+                            ':wid' => $website->id,
+                            ':email' => $email
+                        )
                     );
 
                     $wu = new webuser();
 
                     if(!empty($wu_id))
@@ -328,15 +333,21 @@ function nvweb_webuser($vars=array())
             {
                 // find existing webuser accounts using the same username or email address
                 $DB->query('
                   SELECT COUNT(*) AS total 
                   FROM nv_webusers WHERE
-                  website = '.protect($website->id).'
+                  website = :wid
                     AND (
-                        email = '.protect($email).' OR
-                        username = '.protect(mb_strtolower($username)).'
-                    )'
+                        email = :email OR
+                        username = :username
+                    )',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':email' => $email,
+                        ':username' => mb_strtolower($username)
+                    )
                 );
                 $rs = $DB->result('total');
                 if($rs[0] > 0)
                     $error = t(771, "The specified username (or email address) is already being used on our website");
             }
@@ -456,12 +467,17 @@ function nvweb_webuser($vars=array())
                 if(filter_var($email, FILTER_VALIDATE_EMAIL)!==FALSE)
                 {
                     $wu_id = $DB->query_single(
                         'id',
                         'nv_webusers',
-                        ' email = '.protect($email).'
-                          AND website = '.$website->id
+                        ' email = :email
+                          AND website = :wid',
+                        null,
+                        array(
+                            ':wid' => $website->id,
+                            ':email' => $email
+                        )
                     );
 
                     $wu = new webuser();
 
                     if(!empty($wu_id))
@@ -653,12 +669,16 @@ function nvweb_webuser_generate_username($email)
         // in that case use the full email as username
         // ** if the email already exists, the subscribe process only needs to update the newsletter subscription!
         $wu_id = $DB->query_single(
             'id',
             'nv_webusers',
-            ' LOWER(username) = '.protect($username).'
-                              AND website = '.$website->id
+            ' LOWER(username) = :username AND website = :wid',
+            null,
+            array(
+                ':wid' => $website->id,
+                ':username' => $username
+            )
         );
     }
 
     if(empty($wu_id))
     {
@@ -673,12 +693,16 @@ function nvweb_webuser_generate_username($email)
         $username = $email;
 
         $wu_id = $DB->query_single(
             'id',
             'nv_webusers',
-            ' LOWER(username) = ' . protect($email) . '
-                                    AND website = ' . $website->id
+            ' LOWER(username) = :email AND website = :wid',
+            null,
+            array(
+                ':wid' => $website->id,
+                ':email' => $email
+            )
         );
 
         if(empty($wu_id))
         {
             // proposed username is valid,
diff --git a/login.php b/login.php
index 9c53c85a..a3e0cdb5 100644
--- a/login.php
+++ b/login.php
@@ -23,11 +23,17 @@ if(!empty($_SESSION['APP_USER#'.APP_UNIQUE]))
 $user = new user();
 $website = new website(); // only needed for the users log
 
 if(!empty($_COOKIE['navigate-user']))
 {
-    $nuid = $DB->query_single('id', 'nv_users', 'cookie_hash = '.protect($_COOKIE['navigate-user']));
+    $nuid = $DB->query_single(
+        'id',
+        'nv_users',
+        'cookie_hash = :cookie_hash',
+        NULL,
+        array(':cookie_hash' => $_COOKIE['navigate-user'])
+    );
 
     if(!empty($nuid))
     {
         $user->load($nuid);
         $_SESSION['APP_USER#'.APP_UNIQUE] = $nuid;
@@ -118,20 +124,21 @@ else if(isset($_SERVER['HTTP_ACCEPT_LANGUAGE']))
 /* LOAD LANGUAGE */
 
 $lang = new language();
 $lang->load($language_default);
 
-// is a recover password request?
+// is it a recover password request?
 if($_REQUEST['action']=='forgot-password')
 {
     $value = mb_strtolower(trim($_REQUEST['value']));
     // look for an existing username or e-mail in Navigate CMS users table
     $found_id = $DB->query_single(
         'id',
         'nv_users',
-        ' username = '.protect($value).' OR
-                 email = '.protect($value)
+        ' username = :value OR email = :value',
+        NULL,
+        array(':value' => $value)
     );
 
     if(!$found_id)
         echo 'not_found';
     else
@@ -316,11 +323,13 @@ $(document).ready(function()
 
         // look for an existing username or e-mail in Navigate CMS users table
         $found_id = $DB->query_single(
             'id',
             'nv_users',
-            'activation_key = '.protect($value)
+            'activation_key = :activation_key',
+            NULL,
+            array(':activation_key' => $value)
         );
 
         if(!empty($found_id))
         {
             $user->load($found_id);
diff --git a/web/nvweb_plugins.php b/web/nvweb_plugins.php
index 270e49e9..7403f311 100644
--- a/web/nvweb_plugins.php
+++ b/web/nvweb_plugins.php
@@ -13,11 +13,11 @@ function nvweb_plugins_load()
     if(is_array($plugin_list))
 	{
         // read the database to find the disabled plugins
         $DB->query('SELECT extension, enabled
                       FROM nv_extensions
-                     WHERE website = '.protect($website->id).'
+                     WHERE website = '.intval($website->id).'
                        AND enabled = 0');
 
         $plugins_disabled = $DB->result('extension');
 
         foreach($plugin_list as $plugin_path)
diff --git a/web/nvweb_routes.php b/web/nvweb_routes.php
index a18fe301..0065bfb6 100644
--- a/web/nvweb_routes.php
+++ b/web/nvweb_routes.php
@@ -156,14 +156,20 @@ function nvweb_load_website_by_url($url, $exit=true)
 	}
 
     $DB->query('
 		SELECT id, folder
 		  FROM nv_websites
-		 WHERE subdomain = '.protect($subdomain).'
-		   AND ( domain = '.protect($domain).' OR domain = '.protect($idn->encode($domain)).' ) 
+		 WHERE subdomain = :subdomain
+		   AND ( domain = :domain OR domain = :idn_domain ) 
 		 ORDER BY folder DESC
-	 ');
+	 ',
+        'object',
+        array(
+            ':subdomain' => $subdomain,
+            ':domain' => $domain,
+            ':idn_domain' => $idn->encode($domain)
+        ));
 	$websites = $DB->result();
 
 	if(empty($websites))
 	{
         // no 'real' website found using this address
@@ -349,19 +355,19 @@ function nvweb_route_parse($route="")
 			if($node > 0)
 			{
 				$current['id'] = $node;
 				
 				$DB->query('SELECT * FROM nv_items 
-							 WHERE id = '.protect($current['id']).'
+							 WHERE id = '.intval($current['id']).'
 							   AND website = '.$website->id);
 				$current['object'] = $DB->first();
 				
 				// let's count a hit (except admin)
 				if($current['navigate_session']!=1 && !nvweb_is_bot())
 				{
 					$DB->execute(' UPDATE nv_items SET views = views + 1 
-								   WHERE id = '.$current['id'].' 
+								   WHERE id = '.intval($current['id']).' 
 									 AND website = '.$website->id);
 				}
 
 				$current['type'] = 'item';
 				$current['template'] = $current['object']->template;
@@ -375,19 +381,19 @@ function nvweb_route_parse($route="")
 			if($product > 0)
 			{
 				$current['id'] = $product;
 
 				$DB->query('SELECT * FROM nv_products 
-							 WHERE id = '.protect($current['id']).'
+							 WHERE id = '.intval($current['id']).'
 							   AND website = '.$website->id);
 				$current['object'] = $DB->first();
 
 				// let's count a hit (except admin)
 				if($current['navigate_session']!=1 && !nvweb_is_bot())
 				{
 					$DB->execute(' UPDATE nv_products SET views = views + 1 
-								   WHERE id = '.$current['id'].' 
+								   WHERE id = '.intval($current['id']).' 
 									 AND website = '.$website->id);
 				}
 
 				$current['type'] = 'product';
 				$current['template'] = $current['object']->template;
@@ -443,13 +449,15 @@ function nvweb_route_parse($route="")
 
         // no special route (or already processed), look for the path on navigate routing table
 		default:
 			$DB->query('
                 SELECT * FROM nv_paths 
-				WHERE path = '.protect('/'.$route).' AND 
+				WHERE path = :route AND 
 				      website = '.$website->id.'
-				ORDER BY id DESC'
+				ORDER BY id DESC',
+                'object',
+                array(':route' => '/' . $route)
             );
 			$rs = $DB->result();
 
 			if(empty($rs))
             {
@@ -600,43 +608,43 @@ function nvweb_route_parse($route="")
                         $current['category'] = $current['id'];
 
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_structure SET views = views + 1 
-                                            WHERE id = '.protect($current['id']).' 
+                                            WHERE id = '.intval($current['id']).' 
                                               AND website = '.$website->id);
                         }
                         break;
 
                     case 'item':
                         $DB->query('SELECT * FROM nv_items 
-                                     WHERE id = '.protect($current['id']).'
+                                     WHERE id = '.intval($current['id']).'
                                        AND website = '.$website->id);
 
                         $current['object'] = $DB->first();
 
                         // let's count a hit (except admin)
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_items SET views = views + 1 
-                                           WHERE id = '.$current['id'].' 
+                                           WHERE id = '.intval($current['id']).' 
                                              AND website = '.$website->id);
                         }
                         break;
 
                     case 'product':
                         $DB->query('SELECT * FROM nv_products 
-                                     WHERE id = '.protect($current['id']).'
+                                     WHERE id = '.intval($current['id']).'
                                        AND website = '.$website->id);
 
                         $current['object'] = $DB->first();
 
                         // let's count a hit (except admin)
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_products SET views = views + 1 
-                                           WHERE id = '.$current['id'].' 
+                                           WHERE id = '.intval($current['id']).' 
                                              AND website = '.$website->id);
                         }
                         break;
 
                     case 'feed':
@@ -835,16 +843,21 @@ function nvweb_source_url($type, $id, $lang='')
         if(empty($id))
         {
             $id = $DB->query_single(
                 'id',
                 'nv_items',
-                'website = '.protect($website->id).'
-                 AND template = '.protect($template_type).'
+                'website = :website_id
+                 AND template = :template_type
                  AND permission = 0
                  AND access = 0
                  AND (date_published = 0 OR date_published < '.core_time().')
-                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
+                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
+                NULL,
+                array(
+                    ':website_id' => $website->id,
+                    ':template_type' => $template_type
+                )
             );
             if(!empty($id))
                 $type = 'item';
         }
 
@@ -852,16 +865,21 @@ function nvweb_source_url($type, $id, $lang='')
         if(empty($id))
         {
             $id = $DB->query_single(
                 'id',
                 'nv_structure',
-                'website = '.protect($website->id).'
-                 AND template = '.protect($template_type).'
+                'website = :website_id
+                 AND template = :template_type
                  AND permission = 0
                  AND access = 0
                  AND (date_published = 0 OR date_published < '.core_time().')
-                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
+                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
+                NULL,
+                array(
+                   ':website_id' => $website->id,
+                   ':template_type' => $template_type
+                )
             );
             if(!empty($id))
                 $type = 'structure';
         }
 
@@ -873,14 +891,20 @@ function nvweb_source_url($type, $id, $lang='')
         $type = 'item';
 
     $url = $DB->query_single(
 		'path',
 		'nv_paths',
-		' type = '.protect($type).'
-		   AND object_id = '.protect($id).'
-		   AND lang = '.protect($lang).'
-		   AND website = '.$website->id
+		' type = :type
+		   AND object_id = :object_id
+		   AND lang = :lang
+		   AND website = '.$website->id,
+        NULL,
+        array(
+            ':type' => $type,
+            ':object_id' => $id,
+            ':lang' => $lang
+        )
 	);
 
 	if(empty($url))
 	{
 		if($type=='item')
diff --git a/web/nvweb_templates.php b/web/nvweb_templates.php
index c10a7ec4..6ba17d47 100644
--- a/web/nvweb_templates.php
+++ b/web/nvweb_templates.php
@@ -73,20 +73,25 @@ function nvweb_dictionary_load()
 
 	// webdictionary custom entries
 	$DB->query('SELECT node_id, text
 				  FROM nv_webdictionary 
 				 WHERE node_type = "global"
-				   AND lang = '.protect($session['lang']).'
+				   AND lang = :lang
 				   AND website = '.$website->id.'
 				 UNION
 				 SELECT subtype AS node_id, text
 				 FROM nv_webdictionary
 				 WHERE node_type = "theme"
-				   AND theme = '.protect($website->theme).' 
-				   AND lang = '.protect($session['lang']).'
-				   AND website = '.$website->id
-			   );		
+				   AND theme = :ws_theme 
+				   AND lang = :lang
+				   AND website = '.$website->id,
+        'object',
+        array(
+            ':lang' => $session['lang'],
+            ':ws_theme' => $website->theme,
+        )
+    );
 						
 	$data = $DB->result();
 	
 	if(!is_array($data)) $data = array();
 	
@@ -318,12 +323,16 @@ function nvweb_template_parse($template)
 								'text',
 								'nv_webdictionary', '
 									   node_type = "structure"
 								   AND subtype = "title"
 								   AND node_id = '.$tmp.'
-								   AND lang = '.protect($current['lang']).'
-								   AND website = '.$website->id
+								   AND lang = :lang
+								   AND website = '.$website->id,
+                                NULL,
+                                array(
+                                    ':lang' => $current['lang']
+                                )
 							);
 						}
 						break;
 						
 					case "year":
diff --git a/web/nvweb_xmlrpc.php b/web/nvweb_xmlrpc.php
index dae5dd36..a275fdb6 100644
--- a/web/nvweb_xmlrpc.php
+++ b/web/nvweb_xmlrpc.php
@@ -133,11 +133,11 @@ function nvweb_xmlrpc()
 		{
 			// get all public categories
 			$DB->query('
 				SELECT id
 				  FROM nv_structure
-				 WHERE website = '.protect($website_id).'
+				 WHERE website = '.intval($website_id).'
 				   AND permission < 2
 				ORDER BY parent ASC, position  ASC
 			');
 			$categories = $DB->result();
 
@@ -201,13 +201,15 @@ function nvweb_xmlrpc()
 					        SELECT w.node_id
 					          FROM nv_webdictionary w
 					         WHERE w.website = '.intval($website_id).'
 					           AND w.node_type = "structure"
 					           AND w.subtype = "title"
-					           AND w.text LIKE '.protect($category_name).'
-					   )
-				');
+					           AND w.text LIKE :category_name
+					   )',
+                    'object',
+                    array(':category_name' => $category_name)
+                );
 
 				$category = $DB->result('id');
 				$category = $category[0];
 				if(!isset($post['post_type']) || empty($post['post_type']))
 					$post['post_type'] = 'post';

Vulnerable code:                 $where = 'codename = '.protect($fid);
            $DB->query('SELECT *
                          FROM nv_functions
                         WHERE '.$where.'
                           AND enabled = 1');
        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.background_color") . ' AND website = ' . protect($website->id), 'id DESC');
        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.text_color") . ' AND website = ' . protect($website->id), 'id DESC');
        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.titles_color") . ' AND website = ' . protect($website->id), 'id DESC');
	 * @param string $fetch_mode How to retrieve the data: "object" or "array" 
	public function query($sql, $fetch_mode='object')
			$statement = $this->db->query($sql);
	public function query_single($column, $table, $where = '1=1', $order = '')
            $stm = $this->db->query('SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1');
		if(empty($rs)) 	return NULL;
		else			return $rs[0][0];
	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100)
			$statement = $this->db->query($sql);
		$DB->query('SELECT * FROM nv_languages WHERE code = '.protect($code));
		
		if($DB->query('SELECT * 
						 FROM nv_users 
						WHERE LOWER(username) = '.protect($user)))
                    user = '.protect($this->id).' AND
                    website = '.protect($website->id).' AND 
                    name = '.protect($name)
		$user_profile_name = $DB->query_single('name', 'nv_profiles', 'id='.protect($user->profile));
					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false;">';
			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.0c</a><br />'
                    ' website = '.$website->id.' AND 
                      type = '.protect($theme_blocks[$b]['id'])
				
               SET block_types = '.protect($array).'
			 WHERE id = '.$website->id
            WHERE website = '.protect($website->id),
		if($DB->query('SELECT * FROM nv_block_groups
						WHERE code = '.protect($code).'
						  AND website = '.$website->id))
            'website = '.protect($website->id),
             WHERE website = '.protect($website->id),
			$DB->query('SELECT path as id, path as label, path as value
						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').' 
						'array');
        $DB->query('SELECT * FROM nv_brands WHERE website = '.protect($website->id), 'object');
			 WHERE website = '.protect($website->id),
            ' website = '.protect($website->id).' AND
	        'website = '.protect($website->id).' AND status = 3'
             WHERE website = '.protect($website->id).'
                WHERE website = ' . $this->website . '
                  AND object_type = ' . protect($this->object_type) . '
                  AND object_id = ' . protect($this->object_id) . '
                  AND subscribed = 1
            ');
            WHERE website = '.protect($website->id).' 
            AND user = '.protect($webuser_id).'
            $DB->query('SELECT id, username as text
						  FROM nv_webusers
						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
						 AND website = '.$website->id.'
				      ORDER BY username ASC
					     LIMIT 30',
                'array');
            $DB->query('SELECT c.id, c.date_created, c.name, u.username, c.message
						  FROM nv_comments c
						  LEFT JOIN nv_webusers u ON c.user = u.id
						 WHERE
						    c.website = '.$website->id.' AND
						    c.object_type = '.protect($_REQUEST['object_type']).' AND
						    c.object_id = '.protect($_REQUEST['object_id']).' AND
						    c.date_created <= '.$_REQUEST['maxdate'].' AND
						    c.id <> '.$_REQUEST['exclude'].' AND						     
						    (   c.name LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
						        c.message LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
						        u.username LIKE ' . protect('%' . $_REQUEST['search'] . '%') . '
                            )                          
				      ORDER BY c.date_created DESC
					     LIMIT 30',
                'array');
            $DB->query('SELECT c.*
						  FROM nv_comments c
						  LEFT JOIN nv_webusers u ON c.user = u.id
						 WHERE
						    c.website = '.$website->id.' AND
						    c.id = '.protect($_REQUEST['id']));
			$DB->query('SELECT DISTINCT node_id as id, text as label, text as value
						  FROM nv_webdictionary
						 WHERE node_type = '.protect($_REQUEST['object_type']).'
						   AND subtype = "title"
						   AND website = '.$website->id.' 
						   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
				      ORDER BY text ASC
					     LIMIT 30',
						'array'
        $DB->query('SELECT * FROM nv_coupons WHERE website = '.protect($website->id), 'object');
                    website = '.protect($website->id).' AND
                    webuser = '.protect($webuser).' AND 
                    coupon = '.protect($this->id)
                    website = '.protect($website->id).' AND
                    coupon = '.protect($this->id)
            WHERE website = '.protect($website->id).' AND
                  code = '.protect($code),
            'object'
//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.protect($website->id).' GROUP BY object_id');
                 WHERE p.website = '.protect($website->id).'
         WHERE i.website = '.protect($website->id).'
//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.protect($website->id));
    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id));
    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id).' AND status = -1');
			 WHERE i.website = '.protect($website->id).'
			 WHERE s.website = '.protect($website->id).'
         WHERE i.website = '.protect($website->id).'
           AND p.website = '.protect($website->id).'
         WHERE s.website = '.protect($website->id).'
           AND p.website = '.protect($website->id).'
                 nvwd.lang = '.protect($website->languages_published[0]).'
      WHERE nvc.website = '.$website->id.'
	  ORDER BY nvc.date_created DESC LIMIT '.$comments_limit
        .. WHERE nvc.website = '.protect($website->id).'
                <span data-field="date"></span> 
                <span data-field="username"><strong>'.$public_wall_notes[$e]['username'].'</strong></span>
          SELECT * FROM nv_extensions
          WHERE website = '.protect($this->website).'
            AND extension = '.protect($this->code)
                 WHERE id = '.protect($this->id)
                     AND lang = '.protect($current_language).'
                     AND extension = '.protect($this->code)
             WHERE website = '.protect($website->id),
            $extension_has_options = empty($list[$i]['options']);
    $navibars->add_actions(		array(	'<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'	));

    $navibars->add_actions(	array(	'<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'	)    );
                           AND d.lang = '.protect($current['lang']).'
                        OFFSET 0');
        $DB->query('SELECT * FROM nv_feeds WHERE website = '.protect($website->id), 'object');
			$path = $_REQUEST['path'];
			$id = $_REQUEST['id'];
			
			$DB->query('SELECT type, object_id, lang
	 					  FROM nv_paths
						 WHERE path = '.protect($path).'
						   AND website = '.$website->id);
		$DB->query('  SELECT * FROM nv_files
					   WHERE name LIKE '.protect('%'.$text.'%').'
					     AND website = '.$wid.'
					ORDER BY '.$orderby);
			$wid = $website->id;		
            $text = ' AND name LIKE '.protect('%'.$text.'%');
		$DB->query('  SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
					   WHERE type = '.protect($media).'
					     AND enabled = 1
						 AND website = '.$wid.'
						 '.$text.'
					ORDER BY '.$orderby.'
					   LIMIT '.$limit.' 
					  OFFSET '.$offset);
        $DB->query('SELECT * FROM nv_files WHERE website = '.protect($website->id), 'object');
    $layout->add_script('
             AND item_type = '.protect($item_type).'
             AND item_id = '.protect($item_id).'
             ORDER BY date_created DESC'
                  AND item_type = '.protect($item_type).' 
                  AND item_id = '.protect($item_id).'
                  AND note = ""
            ');
                  WHERE gn.website = '.protect($website->id).'
                    AND gn.item_type = '.protect($type).'
                    AND gn.item_id IN ('.implode(",", $ids).')
                  ORDER BY gn.item_id ASC, gn.date_created DESC'
            WHERE gn.website = ".protect($website->id)."
              AND gn.item_type = ".protect($item_type)."
              AND gn.item_id = ".protect($id)."
              AND gn.user = u.id ".
              $extra."
            ORDER BY gn.date_created DESC"
                WHERE website = '.protect($website->id).'
                  AND id = '.protect($id).'
                WHERE website = '.protect($website->id).'
                  AND item_type = '.protect($object_type).'
                  AND item_id = '.protect($object_id).'
                LIMIT 1'
            WHERE website = '.protect($website->id),
                ' id = '.protect($this->category).' AND website = '.$website->id
                     WHERE website = ' . protect($this->website) . '
                       AND object_id = ' . protect($this->id) . '
        $DB->query('SELECT * FROM nv_items WHERE website = '.protect($website->id), 'object');
                    $tag = $_REQUEST['tag'];
                    $lang = $_REQUEST['lang'];

                                    AND d.lang = '.protect($lang).'
                                    AND d.website = '.$website->id.'
                                 WHERE website = ' . $website->id . '
                                   AND lang = ' . protect($lang) . '
                                   AND FIND_IN_SET('.protect($tag).', text) > 0
                        ORDER BY i.id DESC
                    ');
                            $category_text = '[ '.strtolower(t(100, 'Free')).' ]';
			$DB->query('SELECT id, date_created, autosave
						  FROM nv_webdictionary_history
						 WHERE node_type = "item"
						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
						   AND lang = '.protect($_GET['lang']).'
						   AND node_id = '.protect($_REQUEST['id']).'
						   AND website = '.$website->id.' 
				      ORDER BY date_created DESC',
						'array');		
				   AND lang = '.protect($_REQUEST['lang']).'
				   AND website = '.$website->id.'
				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
				'array'
							   AND website = '.$website->id.' 
							   AND id = '.protect($_REQUEST['id']),							   
				$DB->query('SELECT text
							  FROM nv_webdictionary
							 WHERE node_type = "item"
							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
							   AND lang = '.protect($_REQUEST['lang']).'
							   AND website = '.$website->id.' 
							   AND node_id = '.protect($_REQUEST['node_id']),
							'array');
				$DB->query('SELECT text
							  FROM nv_webdictionary
							 WHERE node_type = "property-item"
							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
							   AND lang = '.protect($_REQUEST['lang']).'
							   AND website = '.$website->id.'
							   AND node_id = '.protect($_REQUEST['node_id']),
							'array');

			$DB->query('SELECT file
						  FROM nv_templates
						 WHERE enabled = 1
						   AND id = '.protect($_REQUEST['id']).'
						   AND website = '.$website->id,
						'array');
			$id = $_REQUEST['id'];
			
			$DB->query('SELECT type, object_id, lang
	 					  FROM nv_paths
						 WHERE path = '.protect($path).'
						   AND website = '.$website->id);
				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
				'array
			');
                $template_filter = ' AND nvi.template = '.protect($_REQUEST['template']).' ';
                $template_filter = ' AND nvi.association = '.protect($_REQUEST['association']).' ';
                $template_filter = ' AND nvi.embedding = '.protect($_REQUEST['embedding']).' ';

            $text = $_REQUEST['title'];
            if(!empty($_REQUEST['term'])) // tagit request
                $text = $_REQUEST['term'];
            
				   AND nvw.website = '.$website->id.'
				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
				        OR
				        ( nvi.id LIKE  ' . protect('%' . $text . '%') . ' 
				          AND
				          nvw.lang = '.protect($website->languages_published[0]).'
				        )
				       )
            $DB->query($sql, 'array');
						'	website = '.protect($website->id).' AND 
			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($item->category).' AND website = '.$website->id);
			$DB->query('SELECT nvc.*, nvwu.username, nvwu.avatar
						  FROM nv_comments nvc
						 LEFT OUTER JOIN nv_webusers nvwu 
						 			  ON nvwu.id = nvc.user
						 WHERE nvc.website = '.protect($website->id).'
						   AND nvc.object_type = "item"
						   AND nvc.object_id = '.protect($item->id).'
						ORDER BY nvc.date_created ASC
						LIMIT 500');
            WHERE `order` = '.protect($this->id).' 
            'reference = '.protect($reference).' AND website = "'.$website_id.'"'
        $DB->query('SELECT * FROM nv_orders WHERE website = '.protect($website->id), 'object');
						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
						   AND website = '.$website->id.'
                        'array');
			 WHERE type = '.protect($type).'
			   AND object_id = '.protect($object_id).'
			   AND website = '.$website_id
			$website_id = $website->id;
	    if(empty($object_id)) throw new Exception('ERROR path: No ID!');
			WHERE type = '.protect($type).'
			  AND object_id = '.protect($object_id).'
			  AND website = '.$website_id
    	  	if(empty($path)) continue;
  			if(!$ok) throw new Exception($DB->get_last_error());
			WHERE website = '.protect($website->id),
        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.protect($website->id), 'object');
            $ws_query = ' AND website = '.protect($website);
             WHERE name = '.protect($name).'
               AND profile = '.intval($profile_id).'
               AND user = '.intval($user_id).
            $ws_query
                WHERE profile = '.protect($object->profile).'
                  AND (website = 0 OR website = '.protect($ws).')'
                 WHERE user = '.protect($object->id).'
                   AND (website = 0 OR website = '.protect($ws).')'
                 WHERE profile = '.protect($object->id).'
                 AND (website = 0 OR website = '.protect($ws).')'
                     WHERE website = ' . protect($this->website) . '
                       AND object_id = ' . protect($this->id) . '
			$like = ' LIKE '.protect('%'.$text.'%');

			$DB->query('SELECT DISTINCT (nvw.node_id)
						 FROM nv_webdictionary nvw
						 WHERE nvw.node_type = "product"
						   AND nvw.website = '.$website->id.'
						   AND nvw.text '.$like, 'array');
			$cols[] = 'p.id' . $like;
        $DB->query('SELECT * FROM nv_products WHERE website = '.protect($website->id), 'object');
                    $tag = $_REQUEST['tag'];
                    $lang = $_REQUEST['lang'];

                                    AND d.lang = '.protect($lang).'
                                    AND d.website = '.$website->id.'
                                 WHERE website = ' . $website->id . '
                                   AND lang = ' . protect($lang) . '
                                   AND FIND_IN_SET('.protect($tag).', text) > 0
                        ORDER BY p.id DESC
                    ');
					$where      =   ' p.website = '.$website->id;
					$sql = ' SELECT SQL_CALC_FOUND_ROWS
					                p.*, d.text as title, d.lang as language,
                                    u.username as author_username,
                                    (   SELECT COUNT(*)
                                        FROM nv_comments cm
                                        WHERE cm.object_type = "product"
                                          AND cm.object_id = p.id
                                          AND cm.website = '.$website->id.'
                                    ) as comments
							   FROM nv_products p
						  LEFT JOIN nv_webdictionary d
						  		 	 ON p.id = d.node_id
								 	AND d.node_type = "product"
									AND d.subtype = "title"
									AND d.lang = '.protect($website->languages_list[0]).'
									AND d.website = '.$website->id.'
						  LEFT JOIN nv_users u
						  			 ON u.id = p.author
							  WHERE '.$where.'							   
						   ORDER BY '.$orderby.' 
							  LIMIT '.$max.'
							 OFFSET '.$offset;

					if(!$DB->query($sql, 'array'))
						throw new Exception($DB->get_last_error());
			$DB->query('SELECT id, date_created, autosave
						  FROM nv_webdictionary_history
						 WHERE node_type = "product"
						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
						   AND lang = '.protect($_GET['lang']).'
						   AND node_id = '.protect($_REQUEST['id']).'
						   AND website = '.$website->id.' 
				      ORDER BY date_created DESC',
						'array');		
				   AND lang = '.protect($_REQUEST['lang']).'
				   AND website = '.$website->id.'
				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
				'array'
				$DB->query('SELECT text
							  FROM nv_webdictionary_history
							 WHERE node_type = "product"
							   AND website = '.$website->id.' 
							   AND id = '.protect($_REQUEST['id']),							   
							'array');	
				$DB->query('SELECT text
							  FROM nv_webdictionary
							 WHERE node_type = "product"
							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
							   AND lang = '.protect($_REQUEST['lang']).'
							   AND website = '.$website->id.' 
							   AND node_id = '.protect($_REQUEST['node_id']),
							'array');
				$DB->query('SELECT text
							  FROM nv_webdictionary
							 WHERE node_type = "property-product"
							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
							   AND lang = '.protect($_REQUEST['lang']).'
							   AND website = '.$website->id.'
							   AND node_id = '.protect($_REQUEST['node_id']),
							'array');
			$path = $_REQUEST['path'];

                 WHERE path = '.protect($path).'
                   AND website = '.$website->id
                 WHERE sku = '.protect($sku).'
                   AND website = '.$website->id
				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
				'array
			');
            $template_filter = '';

	        if(!empty($_REQUEST['template']))
                $template_filter = ' AND nvp.template = '.protect($_REQUEST['template']).' ';

            
				   AND nvw.website = '.$website->id.'
				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
				        OR
				        ( nvp.id LIKE  ' . protect('%' . $text . '%') . ' 
				          AND
				          nvw.lang = '.protect($website->languages_published[0]).'
				        )
            $DB->query($sql, 'array');
				         nvb.name LIKE ' . protect('%' . $text . '%') . '    OR
				         nvb.id LIKE   ' . protect('%' . $text . '%') . '
            $DB->query($sql, 'array');
                 WHERE nvc.website = '.protect($website->id).'
                   AND nvc.object_id = '.protect($item->id).'
                $element = ' AND element = '.protect($element);
            if($DB->query('
                   SELECT *
                   FROM nv_properties
                   WHERE template = '.protect($code).'
                   '.$element.'
                     AND website = '.$website_id.'
                   ORDER BY position ASC, id ASC'
                )
            )
                    ' code = '.protect($code).' AND website = '.$website->id
                $block_group_id = $DB->query_single('id', 'nv_block_groups', ' blocks LIKE '.protect('%'.$item_uid.'%').' AND website = '.$website->id);
                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
 			 WHERE element = '.protect($object_type).'
			   AND node_id = '.protect($object_id).
			   (empty($item_uid)? '' : ' AND ( node_uid = '.protect($item_uid).' OR node_uid = "" OR node_uid IS NULL )').'
			   AND website = '.$website->id,
            'array'
                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$website->id);
                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
                    WHERE property_id = '.protect($property->id).'
                      AND element = '.protect($object_type).'
                      AND node_id = '.protect($object_id).
                      (empty($object_uid)? '' : ' AND node_uid = '.protect($object_uid)).'
                      AND website = '.$website->id
                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$ws->id);
                	  WHERE property_id = '.protect($property->id).'
                        AND element = '.protect($property_object_type).'
                        AND node_id = '.protect($object_id).
                        (empty($node_uid)? '' : ' AND node_uid = '.protect($node_uid)).'
                        AND website = '.$ws->id
                  WHERE website = '.$website_id.'
                    AND element = '.protect($element_type).'
                    AND node_id = '.intval($element_id).'
        ');
        $DB->query('SELECT name
					FROM nv_countries
		 			WHERE lang = '.protect($lang).'
					  AND country_code = '.protect($code));
		$DB->query('SELECT '.$code.' AS country_code, name
					FROM nv_countries
		 			WHERE lang = '.protect($lang).'
					ORDER BY name ASC');
            $country_query = ' AND r.country = '.protect($country_id);
        $DB->query('SELECT name
					FROM nv_countries_regions
		 			WHERE `numeric` = '.protect($code));
            WHERE website = '.protect($website->id).'
              AND property_id = '.protect($property).'
              AND value = '.protect($value),
            'object');
        $DB->query('SELECT * FROM nv_properties WHERE website = '.protect($website->id), 'object');
        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.protect($website->id), 'object');
                            '    node_type = "structure" AND
                                        website = "' . $ws->id . '" AND
                                        node_id = ' . protect($cid) . ' AND
                                        subtype = "title" AND
                                        lang = "' . $ws->languages_published[0] . '"'
                        '   node_type = "item" AND
                        website = "'.$ws->id.'" AND
                        node_id = '.protect($cid).' AND
                        subtype = "title" AND
                        lang = "'.$ws->languages_published[0].'"'
        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.protect($website->id), 'object');
                    $country_id = $DB->query_single('`numeric`', 'nv_countries', 'country_code = '.protect($country_code));
                $rate_regions[] = $DB->query_single('name', 'nv_countries_regions', '`numeric` = ' . protect($rr));
                 WHERE parent = '.protect($this->parent).'
                   AND website = '.protect($this->website)
            ' category = '.protect($this->id).' AND
              website = '.protect($this->website).' AND
        $DB->query('SELECT * FROM nv_structure WHERE website = '.protect($website->id), 'object');
			$id = $_REQUEST['id'];
			$DB->query('SELECT type, object_id, lang
	 					  FROM nv_paths
						 WHERE path = '.protect($path).'
						   AND website = '.$website->id);
                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
				            (nvi.association = "category" AND nvi.embedding=0)
				   AND nvw.website = '.$website->id.'
				   AND nvw.text LIKE '.protect('%'.$text.'%').'
				'array'
                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
				   AND nvw.website = '.$website->id.'
				   AND nvw.text LIKE '.protect('%'.$text.'%').'
					   AND lang = '.protect($_REQUEST['lang']).'
					   AND website = '.$website->id.'
					   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
					'array'
				$DB->query('SELECT text
							  FROM nv_webdictionary
							 WHERE node_type = "property-structure"
							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
							   AND lang = '.protect($_REQUEST['lang']).'
							   AND website = '.$website->id.'
							   AND node_id = '.protect($_REQUEST['node_id']),
							'array');
                                        <small>('.strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
                                        <small>('.strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
                                        <small>('.strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
        $DB->query('SELECT * FROM nv_templates WHERE website = '.protect($website->id), 'object');
				 WHERE website = '.protect($website->id),
                   WHERE website = '.$website->id.'
                     AND lang = '.protect($current_language).'
                     AND theme = '.protect($this->name)
				$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($tmp->category).' AND website = '.$website->id);
                        ' id = '.protect($real[$el_id]->category).' AND 
								  website = '.$ws->id
            $usages = $DB->query_single('COUNT(*)', 'nv_websites', ' theme = '.protect($_REQUEST['theme']));
        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
			WHERE nvul.user = '.protect($user->id).'
			  AND nvul.website = '.protect($website->id).'
			  					   AND nvulm.website = '.protect($website->id).'
			  					   AND nvulm.user = '.protect($user->id).'
			WHERE nvul.user = '.protect($user->id).'
			  AND nvul.function = '.protect($function).'
			  AND nvul.action = '.protect($action).'
			  AND nvul.website = '.protect($website->id).'
			  					   AND nvulm.website = '.protect($website->id).'
			  					   AND nvulm.user = '.protect($user->id).'
			LIMIT '.$limit
							  AND node_type = '.protect('global').'
							  AND website = '.$website->id))
					   AND extension = '.protect($this->extension).'
					   AND subtype = '.protect($this->subtype).'
					   AND website = '.$website->id
				if(!is_array($data)) $data = array();
					$this->text[$item->lang] = $item->text;
					   AND theme = '.protect($theme->name).'
					   AND subtype = '.protect($this->subtype).'
					   AND website = '.$website->id
				$node_id_filter .= ' AND node_id = '.intval($this->node_id);
				$node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
					WHERE website = '.protect($this->website).'
					  AND subtype = '.protect($this->subtype).'
					  AND theme = '.protect($this->theme).' 
					  AND extension = '.protect($this->extension).' 
					  AND node_type = '.protect($this->node_type).
					  $node_id_filter
        $node_id_filter = "";
                $node_id_filter .= ' AND node_id = '.intval($this->node_id);
                $node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
				WHERE subtype = '.protect($this->subtype).'
				  AND node_type = '.protect($this->node_type).'
				  AND theme = '.protect($this->theme).'
				  AND extension = '.protect($this->extension).'
				  AND website = '.protect($this->website).
				  $node_id_filter
				' subtype = '.protect($this->subtype).'
				       AND node_type = '.protect($this->node_type).'
					   AND website = '.$this->website
			 WHERE node_type = '.protect($node_type).'
			   AND node_id = '.protect($node_id).
            (empty($node_uid)? '' : ' AND ( node_uid = '.protect($node_uid).' OR node_uid = "" OR node_uid IS NULL )')
                     WHERE node_type = '.protect($node_type).'
                       AND node_id = '.protect($node_id).'
                       AND website = '.$website_id.'
                       AND lang = '.protect($lang).'
                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')'
                $DB->execute('
                    DELETE FROM nv_webdictionary
                     WHERE node_type = '.protect($node_type).'
                       AND node_id = '.protect($node_id).'
                       AND website = '.$website_id.'
                       AND lang = '.protect($lang).'
                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')
                       AND node_uid = '.protect($node_uid)
                 WHERE node_type = '.protect($node_type).'
                   AND node_id = '.protect($node_id).'
                   AND website = '.$website_id
					$DB->execute('
		                DELETE FROM nv_webdictionary
						WHERE node_id = '.protect($id).'
						  AND node_type = '.protect('global').'
						  AND lang = '.protect($language).'
						  AND website = '.$website->id.'
						LIMIT 1
					');
						WHERE subtype = '.protect($id).'
						  AND node_type = '.protect("theme").'
						  AND theme = '.protect($object).'
						  AND lang = '.protect($language).'
						  AND website = '.$website->id.'
						LIMIT 1
					');
					$DB->execute('
		                DELETE FROM nv_webdictionary
						WHERE subtype = '.protect($id).'
						  AND node_type = '.protect("extension").'
						  AND extension = '.protect($object).'
						  AND lang = '.protect($language).'
						  AND website = '.$website->id.'
						LIMIT 1
					');
        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.protect($website->id), 'object');
					if($litem=='<p><br _mce_bogus="1"></p>') continue;	// tinymce empty contents, no need to save it
					// has the text been changed since last save?
						'   node_id = '.protect($node_id).' AND
							website = '.protect($website_id).' AND
							lang = '.protect($lang).' AND
							subtype = '.protect($subtype).' AND
							node_type = '.protect($node_type).' AND
							autosave = '.protect(($autosave)? '1' : '0').'
						 ORDER BY date_created DESC
						'
								WHERE node_id = '.protect($node_id).' AND
									  website = '.protect($website_id).' AND
										 lang = '.protect($lang).' AND
									  subtype = '.protect($subtype).' AND
									node_type = '.protect($node_type).' AND
								 date_created < '.(core_time() - 86400 * 7)
			 WHERE node_type = '.protect($node_type).'
			   AND node_id = '.protect($node_id).'
			 ORDER BY date_created ASC'
			WHERE website = '.protect($website->id),
        $DB->query('SELECT * FROM nv_websites WHERE id = '.protect($website->id), 'object');
						 WHERE p.website = '.protect($website->id).' AND
						       p.lang = '.protect($lang).' AND
						            p.path LIKE '.protect('%'.$text.'%').'  OR  
									d.text LIKE '.protect('%'.$text.'%').' 
						 LIMIT 10
					');
			$DB->query('SELECT path as id, path as label, path as value
						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').'
						   AND website = '.protect($_REQUEST['wid']).'
						'array');
				    AND text LIKE '.protect("%navigate_download.php%").'
        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
             WHERE website = '.protect($website->id).'
			   AND object  = '.protect($object).'
               AND object_id = '.protect($object_id).'
		 ');
		$DB->queryLimit('wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username', 
						'nv_webuser_votes wuv, nv_webusers wu', 
						'	 wuv.website = '.protect($website->id).'
					   	 AND wuv.object  = '.protect($object).'
 					   	 AND wuv.object_id = '.protect($object_id).'
					   	 AND wu.id = wuv.webuser',
						$orderby, 
						$offset, 
						$limit);
		$fromDate = 0;
			$fromDate = time() - $since*24*60*60;
             WHERE website = '.protect($website->id).'
			   AND object  = '.protect($object).'
               AND object_id = '.protect($object_id).' 
			   AND date > '.$fromDate.'
			 ORDER BY date ASC
        ');
				 WHERE webuser = '.intval($webuser).'
				   AND object  = '.protect($object).'
				   AND object_id = '.protect($object_id)
				   SET `value`	=  '.protect($value).',
						date 	=  '.protect(core_time()).'
				 WHERE id = '.$webuser_vote_id
			   SET votes = '.protect($votes).',
			   	   score = '.protect($score).'
			 WHERE id = '.protect($object_id)
		$DB->query('SELECT COUNT(*) as votes, SUM(value) as score
					  FROM nv_webuser_votes
					 WHERE object_id = '.protect($object_id).'
					   AND object = '.protect($object).'
					   AND website = '.$website->id);	
        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.protect($website->id), 'object');
        $ok = $DB->query('SELECT * FROM nv_webusers WHERE cookie_hash = '.protect($hash));
            ' network = '.protect($network).' AND '.
            ' network_user_id = '.protect($network_user_id)
			$website_check = 'AND website  = '.protect($website);

		if($DB->query('SELECT * 
						 FROM nv_webusers 
						WHERE ( access = 0 OR
						 		(access = 2 AND 
						 			(access_begin = 0 OR access_begin < '.time().') AND 
						 			(access_end = 0 OR access_end > '.time().') 
					            )
					           )
						  '.$website_check.'
						  AND LOWER(username) = '.protect($username))
		)
            'website = '.intval($website).' AND email = '.protect($email)
			 WHERE email = '.protect($email).'
			   AND activation_key = '.protect($hash).'
		');
			 WHERE email = '.protect($email).'
			   AND activation_key = '.protect($hash).'
		');
            ' network = '.protect($network).' AND '.
            ' network_user_id = '.protect($network_user_id)
		if($DB->query('SELECT COUNT(*) as total
					   FROM nv_webusers 
					   WHERE LOWER(username) = '.protect($username).'
					   	 AND website = '.$website_id))
                    WHERE website = ' . protect($website->id) . '
            WHERE website = '.protect($website->id), 'array');
        $DB->query('SELECT * FROM nv_webusers WHERE website = '.protect($website->id), 'object');
                      AND nw.website = '.protect($website->id),
                    WHERE website = '.protect($website->id));
                    WHERE website = '.protect($website->id));
                    WHERE website = '.protect($website->id),
                $query_type = ' AND type = '.protect($vars['type']);
                   AND website = '.$website->id.'
                   AND (date_published = 0 OR date_published < '.core_time().')
                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
                   AND id = '.protect($vars['id'])
                 WHERE type = '.protect($vars['type']).'
                   AND website = '.$website->id.'
                   AND (date_published = 0 OR date_published < '.core_time().')
                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
                ORDER BY position ASC
            ');
                 WHERE type = '.protect($vars['type']).'
                   AND website = '.$website->id.'
                   AND (date_published = 0 OR date_published < '.core_time().')
                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
              ORDER BY position ASC
            ');
        		$fixed_rows_ids = array(0);
                 WHERE type = '.protect($vars['type']).'
                   AND website = '.$website->id.'
                   AND (date_published = 0 OR date_published < '.core_time().')
                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
                   AND id NOT IN('.implode(",", $fixed_rows_ids).')
                 ORDER BY RAND()
            ');
             WHERE nvc.website = '.protect($website->id).'
               AND nvc.object_type = '.protect($object_type).'
               AND nvc.object_id = '.protect($object_id).'
           OFFSET ' . $offset
             WHERE nvc.website = ' . protect($website->id) . '
               AND nvc.object_type = '.protect($object_type).'
               AND nvc.object_id = '.protect($object_id).'
           OFFSET ' . $offset
                                 nvwd.lang = '.protect($current['lang']).'
				 WHERE nvc.website = '.protect($website->id).'
			   OFFSET '.$offset);
                 WHERE i.category IN('.implode(",", $categories).')
                   AND i.website = '.$website->id.'
                   AND (i.date_published = 0 OR i.date_published < '.core_time().')
                   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
                   AND (s.date_published = 0 OR s.date_published < '.core_time().')
                   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
                   AND d.lang = '.protect($current['lang']).'
                 OFFSET 0'
				 WHERE website = '.protect($website->id).'
				   AND object_id = '.protect($item->id).'
				   AND status = 0
            ');
    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.background_color").' AND website = '.protect($website->id), 'id DESC');
    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.text_color").' AND website = '.protect($website->id), 'id DESC');
    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.titles_color").' AND website = '.protect($website->id), 'id DESC');
				 WHERE website = '.protect($website->id).'
				   AND object_id = '.protect($object_id).'
			   AND d.lang = '.protect($current['lang']).'
        '.$limit
             WHERE category = '.protect($current['object']->id).'
               AND website = '.$website->id.'
                                          search_nwdi.website = ' . protect($website->id) . ' AND
                                            search_npi.website = ' . protect($website->id) . ' AND
                                          search_nwdi.website = ' . protect($website->id) . ' AND
                                            search_npi.website = ' . protect($website->id) . ' AND
			 WHERE s.id IN('.implode(",", $categories).')
			   AND s.website = '.$website->id.'
			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
			   AND d.lang = '.protect($current['lang']).'
			OFFSET '.$offset
			 WHERE p.category IN('.implode(",", $categories).')
			   AND p.website = '.$website->id.'
			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
			   AND d.lang = '.protect($current['lang']).'
        $DB->query($query);
                     WHERE i.category IN('.implode(",", $categories).')
                       AND i.website = '.$website->id.'
                       AND (i.date_published = 0 OR i.date_published < '.core_time().')
                       AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
                       AND (s.date_published = 0 OR s.date_published < '.core_time().')
                       AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
                       AND d.lang = '.protect($current['lang']).'                       
                     LIMIT 1
                ');
             WHERE website = '.protect($website->id).'
			 WHERE i.category IN('.implode(",", $categories).')
			   AND i.website = '.$website->id.'
			   AND (i.date_published = 0 OR i.date_published < '.core_time().')
			   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
			   AND d.lang = '.protect($current['lang']).'
		$DB->query($query);
    // now we have all elements that will be shown in the list
                        ' category = '.protect($item->id).' AND
                          website = '.protect($item->website).' AND
                        ');
		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.protect($item->user));
			                    $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
								 WHERE category = '.protect($current['category']).'
								   AND website = '.$website->id.'
            $last = $DB->query_single('parent', 'nv_structure', ' id = '.protect($last));
		$DB->query('SELECT node_id, text
					  FROM nv_webdictionary 
					 WHERE node_type = "structure"
					   AND subtype = "title" 
					   AND lang = '.protect($current['lang']).'
					   AND website = '.$website->id);		
		$DB->query('SELECT object_id, path
					  FROM nv_paths 
					 WHERE type = "structure"
					   AND lang = '.protect($current['lang']).'
					   AND website = '.$website->id);		
			   AND lang = '.protect($current['lang']).'
			   AND website = '.$website->id
		$DB->query('SELECT * 
					  FROM nv_structure
					 WHERE parent = '.protect($parent).' 
					   AND website = '.$website->id.' 
					  ORDER BY position ASC');
                ' node_type = '.protect($current['type']).' AND
				    node_id = '.protect($current['object']->id).' AND
					subtype = '.protect('title').' AND
					website = '.$website->id.' AND
					   lang = '.protect($current['lang'])
				 WHERE website = '.protect($website->id).'
				   AND object_id = '.protect($object_id).'
			   AND d.lang = '.protect($current['lang']).'
        '.$limit
					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.protect($vars['id']));
                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.protect($vars['id']));
				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.protect($vars['id']));
			    $file = $DB->query_single('name', 'nv_files', ' id = '.protect($property->value).' AND website = '.$website->id);
                                                    p.website = '.protect($website->id).' AND
			                                p.website = '.protect($website->id).' AND
                   AND wd.website = ' . protect($website->id) . '			  
                   AND d.website = ' . protect($website->id) . '
        $extra.= ' AND text LIKE '.protect('%'.$search.'%'); // note: we will need to pass another filter after exploding the tags
          WHERE website = '.$website->id.'
            AND node_type IN("'.implode('","', $types).'")
            AND lang = '.protect($lang).'
        'array'
                    ' website = '.protect($website->id).'
					  AND webuser = '.protect($webuser->id).'
					  AND object = '.protect($current['type']).'
					  AND object_id = '.protect($current['id'])
                        ' email = '.protect($email).'
                          AND website = '.$website->id
                  website = '.protect($website->id).'
                        email = '.protect($email).' OR
                        username = '.protect(mb_strtolower($username)).'
                    )'
                        ' email = '.protect($email).'
                          AND website = '.$website->id
            ' LOWER(username) = '.protect($username).'
                              AND website = '.$website->id
            ' LOWER(username) = ' . protect($email) . '
                                    AND website = ' . $website->id
    $nuid = $DB->query_single('id', 'nv_users', 'cookie_hash = '.protect($_COOKIE['navigate-user']));
// is a recover password request?
        ' username = '.protect($value).' OR
                 email = '.protect($value)
            'activation_key = '.protect($value)
                     WHERE website = '.protect($website->id).'
		 WHERE subdomain = '.protect($subdomain).'
		   AND ( domain = '.protect($domain).' OR domain = '.protect($idn->encode($domain)).' ) 
	 ');
							 WHERE id = '.protect($current['id']).'
								   WHERE id = '.$current['id'].' 
							 WHERE id = '.protect($current['id']).'
								   WHERE id = '.$current['id'].' 
				WHERE path = '.protect('/'.$route).' AND 
				ORDER BY id DESC'
                                            WHERE id = '.protect($current['id']).' 
                                     WHERE id = '.protect($current['id']).'
                                           WHERE id = '.$current['id'].' 
                                     WHERE id = '.protect($current['id']).'
                                           WHERE id = '.$current['id'].' 
                'website = '.protect($website->id).'
                 AND template = '.protect($template_type).'
                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
                'website = '.protect($website->id).'
                 AND template = '.protect($template_type).'
                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
		' type = '.protect($type).'
		   AND object_id = '.protect($id).'
		   AND lang = '.protect($lang).'
		   AND website = '.$website->id
				   AND lang = '.protect($session['lang']).'
				   AND theme = '.protect($website->theme).' 
				   AND lang = '.protect($session['lang']).'
				   AND website = '.$website->id
			   );		
								   AND lang = '.protect($current['lang']).'
								   AND website = '.$website->id
				 WHERE website = '.protect($website_id).'
					           AND w.text LIKE '.protect($category_name).'
					   )
				');
Fixed code:             $query_params = NULL;
            {
            }
            {
                $where = 'codename = :codename';
                $query_params = array(':codename' => $fid);
            }
            $DB->query(
                'SELECT * FROM nv_functions WHERE '.$where.' AND enabled = 1',
                'object',
                $query_params
            );
        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.background_color" AND website = ' . intval($website->id), 'id DESC');
        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.text_color" AND website = ' . intval($website->id), 'id DESC');
        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.titles_color" AND website = ' . intval($website->id), 'id DESC');
	 * @param string $fetch_mode How to retrieve the data: "object" or "array"
     * @param array $parameters SQL query parameters associative array
	public function query($sql, $fetch_mode='object', $parameters=array())
		    if(empty($parameters))
            {
			    $statement = $this->db->query($sql);
            }
            else
            {
                $statement = $this->db->prepare($sql);
                $statement->execute($parameters);
            }
     * @param array $parameters SQL query parameters associative array
	public function query_single($column, $table, $where = '1=1', $order = '', $parameters=array())
        $sql = 'SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1';

            if(empty($parameters))
            {
                $stm = $this->db->query($sql);
            }
            else
            {
                $stm = $this->db->prepare($sql);
                $stm->execute($parameters);
            }
		if(empty($rs))
		{
            return NULL;
        }
		else
        {
            return $rs[0][0];
        }
	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100, $parameters=array())
			if(empty($parameters))
            {
                $statement = $this->db->query($sql);
            }
            else
            {
                $statement = $this->db->prepare($sql);
                $statement->execute($parameters);
            }

		$DB->query(
		    'SELECT * FROM nv_languages WHERE code = :code',
            'object',
            array(':code' => $code)
        );
        $found = $DB->query(
            'SELECT * FROM nv_users WHERE LOWER(username) = :username',
            'object',
            array(':username' => $user)
        );

		if(!empty($found))
                    user = :user AND
                    website = :website AND 
                    name = :name',
            'object',
            array(
                ':user' => $this->id,
                ':website' => $website->id,
                ':name' => $name
            )
		$user_profile_name = $DB->query_single(
		    'name',
            'nv_profiles',
            'id = :user_profile',
            'NULL',
            array(':user_profile' => $user->profile)
        );
                159: "'.t(159, 'Name').'",
					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" if(typeof(navitable_quicksearch)==\'function\') { navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false; } else return true;">';
                    if(!text) return;
			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.3</a><br />'
                    ' website = :wid AND type = :type',
                    NULL,
                     array(
                        ':wid' => $website->id,
                        ':type' => $theme_blocks[$b]['id']
                     )

               SET block_types = :block_types
			 WHERE id = :wid',
            array(
                ':wid' => $website->id,
                ':block_types' => $array
            )
            WHERE website = '.intval($website->id),
        $found = $DB->query(
            'SELECT * FROM nv_block_groups
                  WHERE code = :code
                    AND website = '.$website->id,
            'object',
            array(
                ':code' => $code
            )
        );

		if($found)
            'website = '.intval($website->id),
             WHERE website = '.intval($website->id),
			$DB->query(
			    'SELECT path as id, path as label, path as value
						 WHERE path LIKE :path 
                'array',
                array(
                    ':path' => '%' . $_REQUEST['term'] . '%'
                ));
        $DB->query('SELECT * FROM nv_brands WHERE website = '.intval($website->id), 'object');
			 WHERE website = '.intval($website->id),
            ' website = '.intval($website->id).' AND
	        'website = '.intval($website->id).' AND status = 3'
             WHERE website = '.intval($website->id).'
                WHERE website = :wid
                  AND object_type = :otype
                  AND object_id = :oid
                  AND subscribed = 1',
                'object',
                array(
                    ':wid' => $this->website,
                    ':otype' => $this->object_type,
                    ':oid' => $this->object_id
                ));
            WHERE website = '.intval($website->id).' 
            AND user = '.intval($webuser_id).'
            $DB->query(
                'SELECT id, username as text
                      FROM nv_webusers
                     WHERE username LIKE :username
                     AND website = :wid
                  ORDER BY username ASC
                     LIMIT 30',
                'array',
                array(
                    ':wid' => $website->id,
                    ':username' => '%' . $_REQUEST['username'] . '%'
                )
            );
            $DB->query(
                'SELECT c.id, c.date_created, c.name, u.username, c.message
                      FROM nv_comments c
                      LEFT JOIN nv_webusers u ON c.user = u.id
                     WHERE
                        c.website = :wid AND
                        c.object_type = :object_type AND
                        c.object_id = :object_id AND
                        c.date_created <= :maxdate AND
                        c.id <> :exclude AND						     
                        (   c.name LIKE :text OR
                            c.message LIKE :text OR
                            u.username LIKE :text
                        )                          
                  ORDER BY c.date_created DESC
                     LIMIT 30',
                'array',
                array(
                    ':wid' => $website->id,
                    ':object_type' => $_REQUEST['object_type'],
                    ':object_id' => $_REQUEST['object_id'],
                    ':date_created' => $_REQUEST['maxdate'],
                    ':exclude' => $_REQUEST['exclude'],
                    ':text' => '%' . $_REQUEST['search'] . '%'
                )
            );
            $DB->query(
                'SELECT c.*
                      FROM nv_comments c
                      LEFT JOIN nv_webusers u ON c.user = u.id
                     WHERE
                        c.website = '.$website->id.' AND
                        c.id = '.intval($_REQUEST['id'])
            );
			$DB->query(
			    'SELECT DISTINCT node_id as id, text as label, text as value
                      FROM nv_webdictionary
                      WHERE node_type = :object_type
                       AND subtype = "title"
                       AND website = :wid 
                       AND text LIKE :text
                      ORDER BY text ASC
                      LIMIT 30',
                    'array',
                    array(
                        ':object_type' => $_REQUEST['object_type'],
                        ':wid' => $website->id,
                        ':text' => '%'.$_REQUEST['title'].'%'
                    )
        $DB->query('SELECT * FROM nv_coupons WHERE website = '.intval($website->id), 'object');
                    website = '.intval($website->id).' AND
                    webuser = '.intval($webuser).' AND 
                    coupon = '.intval($this->id)
                    website = '.intval($website->id).' AND
                    coupon = '.intval($this->id)
            WHERE website = :wid AND
                  code = :code',
            'object',
            array(
                ':wid' => $website->id,
                ':code' => $code
            )
//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.intval($website->id).' GROUP BY object_id');
                 WHERE p.website = '.intval($website->id).'
         WHERE i.website = '.intval($website->id).'
//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.intval($website->id));
    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id));
    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id).' AND status = -1');
			 WHERE i.website = '.intval($website->id).'
			 WHERE s.website = '.intval($website->id).'
         WHERE i.website = '.intval($website->id).'
           AND p.website = '.intval($website->id).'
         WHERE s.website = '.intval($website->id).'
           AND p.website = '.intval($website->id).'
                 nvwd.lang = :lang
      WHERE nvc.website = :wid
	  ORDER BY nvc.date_created DESC LIMIT '.intval($comments_limit),
        'object',
        array(
            ':wid' => $website->id,
            ':lang' => $website->languages_published[0]
        )
        .. WHERE nvc.website = '.intval($website->id).'

                <span data-field="date">date</span> 
                <span data-field="username"><strong>username</strong></span>
            SELECT * FROM nv_extensions
            WHERE website = :wid
              AND extension = :code',
            'object',
            array(
                ':wid' => $this->website,
                ':code' => $this->code
            )
                 WHERE id = '.intval($this->id)
                     AND lang = :lang
                     AND extension = :code',
                    'object',
                    array(
                        ':lang' => $current_language,
                        ':code' => $this->code
                    )
             WHERE website = '.intval($website->id),
            $extension_has_options = !empty($list[$i]['options']);
    $navibars->add_actions(
        array(
            '<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'
        )
    );

    $navibars->add_actions(
        array(
            '<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'
        )
    );
                           AND d.lang = :lang
                        OFFSET 0',
                'object',
                array(
                    ':lang' => $current['lang']
                )
            );
        $DB->query('SELECT * FROM nv_feeds WHERE website = '.intval($website->id), 'object');
			$DB->query(
			    'SELECT type, object_id, lang
                      FROM nv_paths
                     WHERE path = :path
                       AND website = :wid',
                'object',
                array(
                    ':wid' => $this->website,
                    'path' => $_REQUEST['path']
                )
            );
		$DB->query(
		    'SELECT * FROM nv_files
			  	   WHERE name LIKE :text
				     AND website = :wid
				ORDER BY '.$orderby,
            'object',
            array(
                ':wid' => $wid,
                ':text' => '%' . $text . '%'
            )
        );
        {
			$wid = $website->id;
        }
        {
        }

        $query_params = array(
            ':wid' => $wid,
            ':type' => $media,
        );
		$text_search = "";
        {
            $text_search = ' AND name LIKE :text';
            $query_params[':text'] = '%' . $text . '%';
        }
		$DB->query(
		    'SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
			  WHERE type = :type
                 AND enabled = 1
                 AND website = :wid 
                 '.$text_search.'
            ORDER BY '.$orderby.'
               LIMIT '.$limit.' 
              OFFSET '.$offset,
            'object',
            $query_params
        );
        $DB->query('SELECT * FROM nv_files WHERE website = '.intval($website->id), 'object');
    $layout->add_script('    
             AND item_type = :item_type
             AND item_id = :item_id
             ORDER BY date_created DESC',
            NULL,
            array(
                ':item_type' => $item_type,
                ':item_id' => $item_id
            )
                  AND item_type = :item_type 
                  AND item_id = :item_id
                  AND note = ""',
                array(
                    ':item_type' => $item_type,
                    ':item_id' => $item_id
                )
            );
                  WHERE gn.website = :wid
                    AND gn.item_type = :item_type
                    AND gn.item_id IN (:item_ids)
                  ORDER BY gn.item_id ASC, gn.date_created DESC',
                'object',
                array(
                    ':wid' => $website->id,
                    ':item_type' => $type,
                    ':item_ids' => implode(",", $ids)
                )
            WHERE gn.website = ".intval($website->id)."
              AND gn.item_type = :item_type
              AND gn.item_id = :item_id
              AND gn.user = u.id 
              ".$extra."
            ORDER BY gn.date_created DESC",
            'object',
            array(
                ':item_type' => $item_type,
                ':item_id' => $id
            )
                WHERE website = '.intval($website->id).'
                  AND id = '.intval($id).'
                WHERE website = :wid
                  AND item_type = :object_type
                  AND item_id = :object_id
                LIMIT 1',
            array(
                ':wid' => $website->id,
                ':object_type' => $object_type,
                ':object_id' => $object_id
            )
            WHERE website = '.intval($website->id),
                ' id = '.intval($this->category).' AND website = '.intval($website->id)
                     WHERE website = ' . intval($this->website) . '
                       AND object_id = ' . intval($this->id) . '
        $DB->query('SELECT * FROM nv_items WHERE website = '.intval($website->id), 'object');
                                    AND d.lang = :lang
                                    AND d.website = :wid
                                 WHERE website = :wid
                                   AND lang = :lang
                                   AND FIND_IN_SET(:tag, text) > 0
                        ORDER BY i.id DESC',
                        'object',
                        array(
                            ':lang' => $_REQUEST['lang'],
                            ':wid' => $website->id,
                            ':tag' => $_REQUEST['tag']
                        )
                    );
                            $category_text = '[ '.mb_strtolower(t(100, 'Free')).' ]';
			$DB->query(
			    'SELECT id, date_created, autosave
                      FROM nv_webdictionary_history
                     WHERE node_type = "item"
                       AND subtype = :subtype
                       AND lang = :lang 
                       AND node_id = :node_id
                       AND website = :wid 
                  ORDER BY date_created DESC',
                    'array',
                array(
                    ':wid' => $website->id,
                    ':node_id' => $_REQUEST['id'],
                    ':lang' => $_REQUEST['lang'],
                    ':subtype' => 'section-'.$_REQUEST['section']
                )
            );
				   AND lang = :lang
				   AND website = :wid
				   AND text LIKE :text
				'array',
                array(
                    ':wid' => $website->id,
                    ':lang' => $_REQUEST['lang'],
                    ':text' => '%'.$_REQUEST['title'].'%'
                )
							   AND website = '.intval($website->id).' 
							   AND id = '.intval($_REQUEST['id']),
				$DB->query(
				    'SELECT text
                          FROM nv_webdictionary
                         WHERE node_type = "item"
                           AND subtype = :subtype
                           AND lang = :lang
                           AND website = :wid 
                           AND node_id = :node_id',
                    'array',
                    array(
                        ':wid' => $website->id,
                        ':lang' => $_REQUEST['lang'],
                        ':node_id' => $_REQUEST['node_id'],
                        ':subtype' => 'section-'.$_REQUEST['section']
                    )
                );
				$DB->query(
				    'SELECT text
                          FROM nv_webdictionary
                         WHERE node_type = "property-item"
                           AND subtype = :subtype
                           AND lang = :lang
                           AND website = :wid 
                           AND node_id = :node_id',
                        'array',
                        array(
                            ':wid' => $website->id,
                            ':lang' => $_REQUEST['lang'],
                            ':node_id' => $_REQUEST['node_id'],
                            ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']
                        )
                    );
                
			$DB->query(
			    'SELECT file
                    FROM nv_templates
                   WHERE enabled = 1
                     AND id = '.intval($_REQUEST['id']).'
                     AND website = '.intval($website->id),
                'array'
            );

			$DB->query(
			    'SELECT type, object_id, lang
	 				  FROM nv_paths
					 WHERE path = :path
					   AND website = :wid',
                    'object',
                    array(
                        ':path' => $path,
                        ':wid' => $website->id
                    )
                );
				 WHERE username LIKE :username
				'array',
				array(
				    ':username' => '%' . $_REQUEST['username'] . '%'
                )
			);
            $text = $_REQUEST['title'];
            if(!empty($_REQUEST['term'])) // tagit request
                $text = $_REQUEST['term'];

            $query_params = array(
                ':wid' => $website->id,
                ':lang' => $website->languages_published[0],
                ':text' => '%' . $text . '%'
            );

            {
                $template_filter = ' AND nvi.template = :template ';
                $query_params[':template'] = $_REQUEST['template'];
            }
            {
                $template_filter = ' AND nvi.association = :association ';
                $query_params[':association'] = $_REQUEST['association'];
            }
            {
                $template_filter = ' AND nvi.embedding = :embedding ';
                $query_params[':embedding'] = $_REQUEST['embedding'];
            }

				   AND nvw.website = :wid
				   AND ( nvw.text LIKE :text 
				         OR ( nvi.id LIKE :text AND nvw.lang = :lang )
				   )
            $DB->query($sql, 'array', $query_params);
						'	website = '.intval($website->id).' AND 
			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.intval($item->category).' AND website = '.intval($website->id));
			$DB->query(
			    'SELECT nvc.*, nvwu.username, nvwu.avatar
                      FROM nv_comments nvc
                     LEFT OUTER JOIN nv_webusers nvwu 
                                  ON nvwu.id = nvc.user
                     WHERE nvc.website = '.intval($website->id).'
                       AND nvc.object_type = "item"
                       AND nvc.object_id = '.intval($item->id).'
                    ORDER BY nvc.date_created ASC
                    LIMIT 500'
            );
            WHERE `order` = '.intval($this->id).' 
            'reference = :reference AND website = :wid',
            NULL,
            array(
                ':wid' => $website_id,
                ':reference' => $reference
            )
        $DB->query('SELECT * FROM nv_orders WHERE website = '.intval($website->id), 'object');
						 WHERE username LIKE :username
						   AND website = :wid
                        'array',
                        array(
                            ':wid' => $website->id,
                            ':username' => '%' . $_REQUEST['username'] . '%'
                        )
                    );
			 WHERE type = :type
			   AND object_id = :object_id
			   AND website = :wid',
            'object',
            array(
                ':wid' => $website_id,
                ':object_id' => $object_id,
                ':type' => $type
            )
		{
            $website_id = $website->id;
        }
	    if(empty($object_id))
        {
            throw new Exception('ERROR path: No ID!');
        }
			WHERE type = :type
			  AND object_id = :object_id
			  AND website = :wid',
            array(
                ':wid' => $website_id,
                ':object_id' => $object_id,
                ':type' => $type
            )
        {
        }
    	  	if(empty($path))
            {
                continue;
            }
  			if(!$ok)
            {
                throw new Exception($DB->get_last_error());
            }
			WHERE website = '.intval($website->id),
        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.intval($website->id), 'object');
            $ws_query = ' AND website = '.intval($website);
             WHERE name = :name 
               AND profile = :profile_id 
               AND user = :user_id',
            $ws_query,
            'object',
            array(
                ':name' => $name,
                ':profile_id' => intval($profile_id),
                ':user_id' => intval($user_id)
            )
                WHERE profile = :profile
                  AND (website = 0 OR website = :wid)',
                'object',
                array(
                    ':profile' => $object->profile,
                    ':wid' => $ws
                )
                 WHERE user = :object_id
                   AND (website = 0 OR website = :wid)',
            'object',
                array(
                    ':wid' => $ws,
                    ':object_id' => $object->id
                )
                 WHERE profile = :object_id
                 AND (website = 0 OR website = :wid)',
                'object',
                array(
                    ':wid' => $ws,
                    ':object_id' => $object->id
                )
                     WHERE website = ' . intval($this->website) . '
                       AND object_id = ' . intval($this->id) . '
			$DB->query(
			    'SELECT DISTINCT (nvw.node_id)
                     FROM nv_webdictionary nvw
                     WHERE nvw.node_type = "product"
                       AND nvw.website = '.$website->id.'
                       AND nvw.text LIKE :text',
                'array',
                array(
                    ':text' => '%'.$text.'%'
                )
            );
			$cols[] = 'p.id LIKE ' .  protect('%'.$text.'%').' ';
        $DB->query('SELECT * FROM nv_products WHERE website = '.intval($website->id), 'object');
                                    AND d.lang = :lang
                                    AND d.website = :wid
                                 WHERE website = :wid
                                   AND lang = :lang
                                   AND FIND_IN_SET(:tag, text) > 0
                        ORDER BY p.id DESC',
                        'object',
                        array(
                            ':wid' => $website->id,
                            ':lang' => $_REQUEST['lang'],
                            ':tag' => $_REQUEST['tag']
                        )
                    );
					$where      =   ' p.website = :wid';
                    $query_params = array(
                        ':wid' => $website->id,
                        ':lang' => $website->languages_list[0]
                    );

					$ok = $DB->query(
					    'SELECT SQL_CALC_FOUND_ROWS
                                p.*, d.text as title, d.lang as language,
                                u.username as author_username,
                                (   SELECT COUNT(*)
                                    FROM nv_comments cm
                                    WHERE cm.object_type = "product"
                                      AND cm.object_id = p.id
                                      AND cm.website = :wid
                                ) as comments
                           FROM nv_products p
                      LEFT JOIN nv_webdictionary d
                                 ON p.id = d.node_id
                                AND d.node_type = "product"
                                AND d.subtype = "title"
                                AND d.lang = :lang
                                AND d.website = :wid
                      LEFT JOIN nv_users u
                                 ON u.id = p.author
                          WHERE '.$where.'							   
                       ORDER BY '.$orderby.' 
                          LIMIT '.$max.'
                         OFFSET '.$offset,
                        'array',
                        $query_params
                    );

					if(!$ok)
					{
                        throw new Exception($DB->get_last_error());
                    }
			$DB->query(
			    'SELECT id, date_created, autosave
                      FROM nv_webdictionary_history
                     WHERE node_type = "product"
                       AND subtype = :subtype
                       AND lang = :lang
                       AND node_id = :node_id
                       AND website = :wid 
                  ORDER BY date_created DESC',
                'array',
                array(
                    ':wid' => $website->id,
                    ':lang' => $_REQUEST['lang'],
                    ':node_id' => $_REQUEST['id'],
                    ':subtype' => 'section-'.$_REQUEST['section']
                )
            );
				   AND lang = :lang
				   AND website = :wid
				   AND text LIKE :text
				'array',
                array(
                    ':wid' => $website->id,
                    ':lang' => $_REQUEST['lang'],
                    ':text' => '%' . $_REQUEST['title'] . '%'
                )
				$DB->query(
				    'SELECT text
                          FROM nv_webdictionary_history
                         WHERE node_type = "product"
                           AND website = '.intval($website->id).' 
                           AND id = '.intval($_REQUEST['id']),
                    'array'
                );
				$DB->query(
				    'SELECT text
                          FROM nv_webdictionary
                         WHERE node_type = "product"
                           AND subtype = :subtype
                           AND lang = :lang
                           AND website = :wid 
                           AND node_id = :node_id',
                    'array',
                    array(
                        ':wid' => $website->id,
                        ':lang' => $_REQUEST['lang'],
                        ':subtype' => 'section-'.$_REQUEST['section'],
                        ':node_id' => $_REQUEST['node_id']
                    )
                );
				$DB->query(
				    'SELECT text
                          FROM nv_webdictionary
                         WHERE node_type = "property-product"
                           AND subtype = :subtype
                           AND lang = :lang
                           AND website = :wid
                           AND node_id = :node_id',
                    'array',
                    array(
                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
                        ':lang' => $_REQUEST['lang'],
                        ':wid' => $website->id,
                        ':node_id' => $_REQUEST['node_id']
                    )
                );
                 WHERE path = :path
                   AND website = :wid',
            'object',
                array(
                    ':wid' => $website->id,
                    ':path' => $_REQUEST['path']
                )
                 WHERE sku = :sku
                   AND website = :wid',
            'object',
                array(
                    ':sku' => $sku,
                    ':wid' => $website->id
                )
				 WHERE username LIKE :username
				'array',
                array(
                    ':username' => '%'.$_REQUEST['username'].'%'
                )
            );
            {
            }

            $query_params = array(
                ':wid' => $website->id,
                ':lang' => $website->languages_published[0],
                ':text' => '%' . $text . '%'
            );

            $template_filter = '';
            if(!empty($_REQUEST['template']))
            {
                $template_filter = ' AND nvp.template = :template ';
                $query_params[':template'] = $_REQUEST['template'];
            }

				   AND nvw.website = :wid
				   AND ( nvw.text LIKE :text 
				        OR ( nvp.id LIKE :text AND nvw.lang = :lang )
            $DB->query($sql, 'array', $query_params);
				         nvb.name LIKE :text OR
				         nvb.id LIKE :text
            $DB->query(
                $sql,
                'array',
                array(
                    ':text' => '%' . $text . '%'
                )
            );
    {
    }
                 WHERE nvc.website = '.intval($website->id).'
                   AND nvc.object_id = '.intval($item->id).'
            $query_params = array(
                ':template' => $code,
                ':wid' => $website_id
            );

            {
                $element = ' AND element = :element ';
                $query_params[':element'] = $element;
            }
            {
            }
            $ok = $DB->query(
            'SELECT * FROM nv_properties
                 WHERE template = :template
                  '.$element.'
                  AND website = :wid
                ORDER BY position ASC, id ASC',
                'object',
                $query_params
            );

            if($ok)
                    ' code = :code AND website = :wid',
                    NULL,
                    array(
                        ':wid' => $website->id,
                        ':code' => $code
                    )
                $block_group_id = $DB->query_single(
                    'id',
                    'nv_block_groups',
                    ' blocks LIKE :uid AND website = :wid',
                    NULL,
                    array(
                        ':wid' => $website->id,
                        ':uid' => '%'.$item_uid.'%'
                    )
                );
                $block_group_id = $DB->query_single(
                    'MAX(id)',
                    'nv_block_groups',
                    ' code = :object_id AND website = :wid',
                    null,
                    array(
                        ':wid' => $website->id,
                        ':object_id' => $object_id
                    )
                );
        $query_params = array(
            ':wid' => $website->id,
            ':object_type' => $object_type,
            ':object_id' => $object_id
        );

        $uid_filter = '';
        if(!empty($item_uid))
        {
            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
            $query_params[':node_uid'] = $item_uid;
        }

 			 WHERE element = :object_type
			   AND node_id = :object_id
			   '.$uid_filter.'			   
			   AND website = :wid',
            'array',
            $query_params
                $block_group_id = $DB->query_single(
                    'MAX(id)',
                    'nv_block_groups',
                    ' code = :code AND website = :wid',
                    null,
                    array(
                        ':wid' => $website->id,
                        ':code' => $code
                    )
                );
                $block_group_id = $DB->query_single(
                    'MAX(id)',
                    'nv_block_groups',
                    ' code = :object_id AND website = :wid',
                    null,
                    array(
                        ':wid' => $website->id,
                        ':object_id' => $object_id
                    )
                );
            $query_params = array(
                ':wid' => $website->id,
                ':property_id' => $property->id,
                ':object_type' => $object_type,
                ':object_id' => $object_id
            );

            $uid_filter = '';
            if(!empty($object_uid))
            {
                $uid_filter = ' AND node_uid = :object_uid ';
                $query_params[':object_uid'] = $object_uid;
            }

                    WHERE property_id = :property_id
                      AND element = :object_type
                      AND node_id = :object_id
                      '.$uid_filter.'
                      AND website = :wid',
                $query_params
                $block_group_id = $DB->query_single(
                    'MAX(id)',
                    'nv_block_groups',
                    ' code = :code AND website = :wid',
                    null,
                    array(
                        ':code' => $code,
                        ':wid' => $ws->id
                    )
                );

            $query_params = array(
                ':wid' => $ws->id,
                ':object_id' => $object_id,
                ':pr_object_type' => $property_object_type,
                ':pr_id' => $property->id
            );

            $uid_filter = '';
            if(!empty($node_uid))
            {
                $uid_filter = ' AND node_uid = :node_uid ';
                $query_params[':node_uid'] = $node_uid;
            }

                	  WHERE property_id = :pr_id
                        AND element = :pr_object_type
                        AND node_id = :object_id                        
                        AND website = :wid
                        '.$uid_filter,
                $query_params
                  WHERE website = :wid
                    AND element = :e_type
                    AND node_id = :e_id ',
            array(
                ':wid' => $website_id,
                ':e_type' => $element_type,
                ':e_id' => $element_id
            )
        );
        $DB->query(
            'SELECT name
			 	  FROM nv_countries
		 		  WHERE lang = :lang
				    AND country_code = :ccode',
            'object',
            array(
                ':ccode' => $code,
                ':lang' => $lang
            )
        );
		$DB->query(
		    'SELECT '.$code.' AS country_code, name
			  	  FROM nv_countries
		 		  WHERE lang = :lang
				  ORDER BY name ASC',
            'object',
            array(
                ':lang' => $lang
            )
        );
            $country_query = ' AND r.country = '.intval($country_id);
        $DB->query(
            'SELECT name
			  	  FROM nv_countries_regions
		 		  WHERE `numeric` = '.intval($code)
        );
            WHERE website = '.intval($website->id).'
              AND property_id = :property_id 
              AND value = :value',
            'object',
            array(
                ':proeprty_id' => $property,
                ':value' => $value
            )
        );
        $DB->query('SELECT * FROM nv_properties WHERE website = '.intval($website->id), 'object');
        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.intval($website->id), 'object');
                            '    
                                node_type = "structure" AND
                                website = :wid AND
                                node_id = :node_id AND
                                subtype = "title" AND
                                lang = :lang',
                            NULL,
                            array(
                                ':wid' => $ws->id,
                                ':lang' => $ws->languages_published[0],
                                ':node_id' => $cid
                            )
                        '   
                            node_type = "item" AND
                            website = :wid AND
                            node_id = :node_id AND
                            subtype = "title" AND
                            lang = :lang',
                        NULL,
                        array(
                            ':wid' => $ws->id,
                            ':node_id' => $cid,
                            ':lang' => $ws->languages_published[0]
                        )
        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.intval($website->id), 'object');
                    $country_id = $DB->query_single(
                        '`numeric`',
                        'nv_countries',
                        'country_code = :ccode',
                        null,
                        array(
                            ':ccode' => $country_code
                        )
                    );
            {
                $rate_regions[] = $DB->query_single(
                    'name',
                    'nv_countries_regions',
                    '`numeric` = ' . intval($rr)
                );
            }
                 WHERE parent = '.intval($this->parent).'
                   AND website = '.intval($this->website)
            ' category = '.intval($this->id).' AND
              website = '.intval($this->website).' AND
        $DB->query('SELECT * FROM nv_structure WHERE website = '.intval($website->id), 'object');
			$DB->query(
			    'SELECT type, object_id, lang
	 			 	   FROM nv_paths
					  WHERE path = :path 
					    AND website = :wid',
                'object',
                array(
                    ':wid' => $website->id,
                    ':path' => $path
                ));
            $query_params = array(
                ':wid' => $website->id,
                ':text' => '%' . $text . '%'
            );

            {
                $language_filter = ' AND nvw.lang = :lang ';
                $query_params[':lang'] = $_REQUEST['lang'];
            }
				            (nvi.association = "category" AND nvi.embedding = 0)
				   AND nvw.website = :wid
				   AND nvw.text LIKE :text
				'array',
                $query_params
            $query_params = array(
                ':wid' => $website->id,
                ':text' => '%'.$text.'%'
            );

            {
                $language_filter = ' AND nvw.lang = :lang ';
                $query_params[':lang'] = $_REQUEST['lang'];
            }
				   AND nvw.website = :wid
				   AND nvw.text LIKE :text
					   AND lang = :lang 
					   AND website = :wid
					   AND text LIKE :text
					'array',
                array(
                    ':wid' => $website->id,
                    ':lang' => $_REQUEST['lang'],
                    ':text' => '%'.$_REQUEST['title'].'%'
                )
				$DB->query(
				    'SELECT text
                      FROM nv_webdictionary
                     WHERE node_type = "property-structure"
                       AND subtype = :subtype
                       AND lang = :lang							   
                       AND website = :wid
                       AND node_id = :node_id',
                    'array',
                    array(
                        ':wid' => $website->id,
                        ':lang' => $_REQUEST['lang'],
                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
                        ':node_id' => $_REQUEST['node_id']
                    ));
                                        <small>('.mb_strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
                                        <small>('.mb_strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
                                        <small>('.mb_strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
        $DB->query('SELECT * FROM nv_templates WHERE website = '.intval($website->id), 'object');
				 WHERE website = '.intval($website->id),
                   WHERE website = :wid
                     AND lang = :lang
                     AND theme = :theme',
                    'object',
                    array(
                        ':wid' => $website->id,
                        ':lang' => $current_language,
                        ':theme' => $this->name
                    )
                {
                }
				$template_id = $DB->query_single(
				    'template',
                    'nv_structure',
                    ' id = :category AND website = :wid',
                    null,
                    array(
                        ':wid' => $website->id,
                        ':category' => $tmp->category
                    )
                );
                        ' id = '.intval($real[$el_id]->category).' AND 
								  website = '.intval($ws->id)
            $usages = $DB->query_single(
                'COUNT(*)',
                'nv_websites',
                ' theme = :theme',
                null,
                array(
                    ':theme' => $_REQUEST['theme']
                )
            );
        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
			WHERE nvul.user = '.intval($user->id).'
			  AND nvul.website = '.intval($website->id).'
			  					   AND nvulm.website = '.intval($website->id).'
			  					   AND nvulm.user = '.intval($user->id).'
			WHERE nvul.user = :user_id
			  AND nvul.function = :function
			  AND nvul.action = :action
			  AND nvul.website = :wid
			  					   AND nvulm.website = :wid
			  					   AND nvulm.user = :user_id
			LIMIT '.$limit,
        'object',
            array(
                ':wid' => $website->id,
                ':action' => $action,
                ':function' => $function,
                ':user_id' => $user->id
            )
							  AND node_type = "global"
							  AND website = '.intval($website->id))
            )
					   AND extension = :extension
					   AND subtype = :subtype
					   AND website = :wid',
                    'object',
                    array(
                        ':wid' => $website->id,
                        ':subtype' => $this->subtype,
                        ':extension' => $this->extension
                    )
				if(!is_array($data))
				{
				    $data = array();
                }
                {
                    $this->text[$item->lang] = $item->text;
                }
					   AND theme = :theme 
					   AND subtype = :subtype 
					   AND website = :wid',
                    'object',
                    array(
                        ':wid' => $website->id,
                        ':subtype' => $this->subtype,
                        ':theme' => $theme->name
                    )
		    $query_params = array(
                ':wid' => $this->website,
                ':subtype' => $this->subtype,
                ':theme' => $this->theme,
                ':extension' => $this->extension,
                ':node_type' => $this->node_type
            );

            {
				$node_id_filter .= ' AND node_id = :node_id ';
				$query_params[':node_id'] = $this->node_id;
            }
            {
				$node_id_filter .= ' AND node_uid = :node_uid ';
                $query_params[':node_uid'] = $this->node_uid;
            }
					WHERE website = :wid 
					  AND subtype = :subtype
					  AND theme = :theme  
					  AND extension = :extension  
					  AND node_type = :node_type
					  '.$node_id_filter,
                $query_params
        $node_filter = "";
		    $query_params = array(
                ':wid' => $this->website,
                ':extension' => $this->extension,
                ':theme' => $this->theme,
                ':node_type' => $this->node_type,
                ':subtype' => $this->subtype
            );

            {
                $node_filter .= ' AND node_id = :node_id ';
                $query_params[':node_id'] = $this->node_id;
            }
            {
                $node_filter .= ' AND node_uid = :node_uid ';
                $query_params[':node_uid'] = $this->node_uid;
            }
				WHERE subtype = :subtype
				  AND node_type = :node_type
				  AND theme = :theme 
				  AND extension = :extension 
				  AND website = :wid
				  '.$node_filter,
                $query_params
				' subtype = :subtype 
				       AND node_type = :node_type 
					   AND website = :wid',
                null,
                array(
                    ':wid' => $this->website,
                    ':subtype' => $this->subtype,
                    ':node_type' => $this->node_type
                )

		$query_params = array(
            ':node_type' => $node_type,
            ':node_id' => $node_id
        );

		$uid_filter = '';
		if(!empty($node_uid))
        {
            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
            $query_params[':node_uid'] = $node_uid;
        }

			 WHERE node_type = :node_type
			   AND node_id = :node_id 
            '.$uid_filter,
            'object',
            $query_params
                     WHERE node_type = :node_type
                       AND node_id = :node_id 
                       AND website = :wid 
                       AND lang = :lang
                       AND subtype IN (:subtype)',
                    array(
                        ':wid' => $website_id,
                        ':lang' => $lang,
                        ':node_id' => $node_id,
                        ':node_type' => $node_type,
                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes))
                    )
                $DB->execute(
                    'DELETE FROM nv_webdictionary
                         WHERE node_type = :node_type
                           AND node_id = :node_id 
                           AND website = :wid 
                           AND lang = :lang
                           AND subtype IN (:subtype)
                           AND node_uid = :node_uid',
                    array(
                        ':wid' => $website_id,
                        ':lang' => $lang,
                        ':node_id' => $node_id,
                        ':node_type' => $node_type,
                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes)),
                        ':node_uid' => $node_uid
                    )
                 WHERE node_type = :node_type 
                   AND node_id = :node_id 
                   AND website = :wid',
                array(
                    ':wid' => $website_id,
                    ':node_type' => $node_type,
                    ':node_id' => $node_id
                )
					$DB->execute(
                    'DELETE FROM nv_webdictionary
						WHERE node_id = :id 
						  AND node_type = "global"
						  AND lang = :lang 
						  AND website = :wid
						LIMIT 1',
                        array(
                            ':wid' => $website->id,
                            ':lang' => $language,
                            ':id' => $id
                        )
                    );
						WHERE subtype = :id 
						  AND node_type = "theme"
						  AND theme = :object
						  AND lang = :lang 
						  AND website = :wid
						LIMIT 1',
                        array(
                            ':wid' => $website->id,
                            ':lang' => $language,
                            ':object' => $object,
                            ':id' => $id
                        )
                    );
					$DB->execute(
                    'DELETE FROM nv_webdictionary
						WHERE subtype = :id
						  AND node_type = "extension"
						  AND extension = :object 
						  AND lang = :lang
						  AND website = :wid
						LIMIT 1',
                        array(
                            ':id' => $id,
                            ':object' => $object,
                            ':lang' => $language,
                            ':wid' => $website->id
                        )
                    );
        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.intval($website->id), 'object');
					if($litem=='<p><br _mce_bogus="1"></p>')
                    {
                        // equals to tinymce empty content, so no need to save it
                        continue;
                    }
					// has the text been changed since the last save?
						'   
						    node_id = :node_id AND
							website = :wid AND
							lang = :lang AND
							subtype = :subtype AND
							node_type = :node_type AND
							autosave = '.(($autosave)? '1' : '0').'
						 ORDER BY date_created DESC',
                        null,
                        array(
                            ':wid' => $website_id,
                            ':node_id' => $node_id,
                            ':lang' => $lang,
                            ':subtype' => $subtype,
                            ':node_type' => $node_type
                        )
								WHERE node_id = :node_id AND
									  website = :wid AND
										 lang = :lang AND
									  subtype = :subtype AND
									node_type = :node_type AND
								 date_created < '.(core_time() - 86400 * 7),
                                array(
                                    ':wid' => $website_id,
                                    ':lang' => $lang,
                                    ':node_id' => $node_id,
                                    ':node_type' => $node_type,
                                    ':subtype' => $subtype
                                )
			 WHERE node_type = :node_type 
			   AND node_id = :node_id
			 ORDER BY date_created ASC',
            'object',
            array(
                ':node_type' => $node_type,
                ':node_id' => $node_id
            )
			WHERE website = '.intval($website->id),
        $DB->query('SELECT * FROM nv_websites WHERE id = '.intval($website->id), 'object');
						 WHERE p.website = :website_id AND
						       p.lang = :lang AND
						            p.path LIKE :text  OR  
									d.text LIKE :text 
						 LIMIT 10',
                        'object',
                        array(
					        ':website_id' => $website->id,
                            ':lang' => $lang,
                            ':text' => '%' . $text . '%'
                        )
                    );
			$DB->query(
			    'SELECT path as id, path as label, path as value
						 WHERE path LIKE :term
						   AND website = :website_id
                'array',
                array(
                    ':website_id' => $_REQUEST['wid'],
                    ':term' => '%'.$_REQUEST['term'].'%'
                ));
				    AND text LIKE "%navigate_download.php%"
        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
             WHERE website = :wid
			   AND object  = :object
               AND object_id = :object_id
		 ',
            'object',
            array(
                ':wid' => $website->id,
                ':object' => $object,
                ':object_id' => $object_id
            )
        );
		$DB->queryLimit(
		    'wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username',
			'nv_webuser_votes wuv, nv_webusers wu',
			'	 
			    wuv.website = :wid 
			    AND wuv.object  = :object 
 				AND wuv.object_id = :object_id
				AND wu.id = wuv.webuser',
            $orderby,
            $offset,
            $limit,
            array(
                ':wid' => $website->id,
                ':object' => $object,
                ':object_id' => $object_id
            )
        );
		$from_date = 0;
			$from_date = time() - $since * 24*60*60;
             WHERE website = :wid
			   AND object  = :object
               AND object_id = :object_id 
			   AND date > :from_date
			 ORDER BY date ASC',
            'object',
            array(
                ':wid' => $website->id,
                ':object' => $object,
                ':object_id' => $object_id,
                ':from_date' => $from_date
            )
        );
				 WHERE webuser = :webuser 
				   AND object  = :object
				   AND object_id = :object_id',
        'object',
                array(
                    ':webuser' => $webuser,
                    ':object' => $object,
                    ':object_id' => $object_id
                )
				   SET `value`	=  :value,
						date 	=  :time
				 WHERE id = :wu_vote_id',
                array(
                    ':wu_vote_id' => $webuser_vote_id,
                    ':time' => core_time(),
                    ':value' => $value
                )
			   SET  votes = :votes, 
			        score = :score
			 WHERE id = :object_id',
            array(
                ':votes' => $votes,
                ':score' => $score,
                ':object_id' => $object_id
            )
		$DB->query(
		    'SELECT COUNT(*) as votes, SUM(value) as score
                  FROM nv_webuser_votes
                 WHERE object_id = :object_id
                   AND object = :object
                   AND website = :wid',
            'object',
            array(
                ':wid' => $website->id,
                ':object' => $object,
                ':object_id' => $object_id
            ));
        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.intval($website->id), 'object');
        $ok = $DB->query(
            'SELECT * FROM nv_webusers WHERE cookie_hash = :hash',
            'object',
            array(
                ':hash' => $hash
            )
        );

        {
        }
            ' network = :network AND network_user_id = :network_uid',
            null,
            array(
                ':network' => $network,
                ':network_uid' => $network_user_id
            )
        {
        }
			$website_check = 'AND website  = '.intval($website);

		$ok = $DB->query(
		    'SELECT * 
                     FROM nv_webusers 
                    WHERE ( access = 0 OR
                            (access = 2 AND 
                                (access_begin = 0 OR access_begin < '.time().') AND 
                                (access_end = 0 OR access_end > '.time().') 
                            )
                           )
                      '.$website_check.'
                      AND LOWER(username) = :username',
        'object',
            array(
                ':username' => $username
            )
        );

		if($ok)
            'website = :wid AND email = :email',
            null,
            array(
                ':wid' => $website,
                ':email' => $email
            )
			 WHERE email = :email
			   AND activation_key = :hash',
            'object',
            array(
                ':email' => $email,
                ':hash' => $hash
            )
        );
			 WHERE email = :email
			   AND activation_key = :hash',
            'object',
            array(
                ':email' => $email,
                ':hash' => $hash
            )
        );
            ' network = :network AND '.
            ' network_user_id = :network_uid',
            null,
            array(
                ':network' => $network,
                ':network_uid' => $network_user_id
            )
		if($DB->query(
		    'SELECT COUNT(*) as total
                   FROM nv_webusers 
                   WHERE LOWER(username) = :username
                     AND website = :wid',
                array(
                    ':wid' => $website_id,
                    ':username' => $username
                )
            )
        )
                    WHERE website = ' . intval($website->id) . '
            WHERE website = '.intval($website->id), 'array');
        $DB->query('SELECT * FROM nv_webusers WHERE website = '.intval($website->id), 'object');
                      AND nw.website = '.intval($website->id),
                    WHERE website = '.intval($website->id));
                    WHERE website = '.intval($website->id));
                    WHERE website = '.intval($website->id),
            $query_params = array(
                ':wid' => $website->id,
                ':time' => core_time(),
                ':id' => $vars['id']
            );

            {
                $query_type = ' AND type = :type';
                $query_params[':type'] = $vars['type'];
            }
                   AND website = :wid
                   AND (date_published = 0 OR date_published < :time)
                   AND (date_unpublish = 0 OR date_unpublish > :time)
                   AND id = :id',
                'object',
                $query_params
            $query_params = array(
                ':wid' => $website->id,
                ':time' => core_time(),
                ':type' => $vars['type']
            );

                 WHERE type = :type
                   AND website = :wid
                   AND (date_published = 0 OR date_published < :time)
                   AND (date_unpublish = 0 OR date_unpublish > :time)
                ORDER BY position ASC',
                'object',
                $query_params
            );
            $query_params = array(
                ':wid' => $website->id,
                ':time' => core_time(),
                ':type' => $vars['type']
            );

                 WHERE type = :type
                   AND website = :wid
                   AND (date_published = 0 OR date_published < :time)
                   AND (date_unpublish = 0 OR date_unpublish > :time)
              ORDER BY position ASC',
                'object',
                $query_params
            );
            {
                $fixed_rows_ids = array(0);
            }

        	$query_params[':fr_ids'] = implode(",", $fixed_rows_ids);
                 WHERE type = :type
                   AND website = :wid
                   AND (date_published = 0 OR date_published < :time)
                   AND (date_unpublish = 0 OR date_unpublish > :time)
                   AND id NOT IN(:fr_ids)
                 ORDER BY RAND()',
                $query_params
            );
             WHERE nvc.website = :wid 
               AND nvc.object_type = :object_type
               AND nvc.object_id = :object_id 
           OFFSET ' . $offset,
            'object',
            array(
                ':wid' => $website->id,
                ':object_type' => $object_type,
                ':object_id' => $object_id
            )
             WHERE nvc.website = :wid
               AND nvc.object_type = :object_type
               AND nvc.object_id = :object_id 
           OFFSET ' . $offset,
            'object',
            array(
                ':wid' => $website->id,
                ':object_type' => $object_type,
                ':object_id' => $object_id
            )
                                 nvwd.lang = :lang
				 WHERE nvc.website = :wid
			   OFFSET '.$offset,
        array(
            ':wid' => $website->id,
            ':lang' => $current['lang']
        )
    );
                 WHERE i.category IN(:categories)
                   AND i.website = :wid
                   AND (i.date_published = 0 OR i.date_published < :time)
                   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                   AND (s.date_published = 0 OR s.date_published < :time)
                   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                   AND d.lang = :lang
                 OFFSET 0',
            'object',
                array(
                    ':wid' => $website->id,
                    ':lang' => $current['lang'],
                    ':categories' => implode(",", $categories),
                    ':time' => core_time()
                )
				 WHERE website = :wid
				   AND object_id = :item_id
				   AND status = 0',
                'object',
                array(
                    ':wid' => $website->id,
                    ':item_id' => $item->id
                )
            );
    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.background_color" AND website = '.intval($website->id), 'id DESC');
    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.text_color" AND website = '.intval($website->id), 'id DESC');
    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.titles_color" AND website = '.intval($website->id), 'id DESC');
				 WHERE website = '.intval($website->id).'
				   AND object_id = '.intval($object_id).'
			   AND d.lang = :lang
        '.$limit,
        'object',
        array(
            ':lang' => $current['lang']
        )
             WHERE category = '.intval($current['object']->id).'
               AND website = '.intval($website->id).'
                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                            search_npi.website = ' . intval($website->id) . ' AND
                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                            search_npi.website = ' . intval($website->id) . ' AND
			 WHERE s.id IN(:categories)
			   AND s.website = :wid
			   AND (s.date_published = 0 OR s.date_published < :time)
			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
			   AND d.lang = :lang
			OFFSET '.$offset,
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang'],
                ':time' => core_time(),
                ':categories' => implode(",", $categories)
            )
			 WHERE p.category IN(:categories)
			   AND p.website = :wid
			   AND (s.date_published = 0 OR s.date_published < :time)
			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
			   AND d.lang = :lang
        $DB->query(
            $query,
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang'],
                ':time' => core_time(),
                ':categories' => implode(",", $categories)
            )
        );
                     WHERE i.category IN(:categories)
                       AND i.website = :wid
                       AND (i.date_published = 0 OR i.date_published < :time)
                       AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                       AND (s.date_published = 0 OR s.date_published < :time)
                       AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                       AND d.lang = :lang                       
                     LIMIT 1',
                    'object',
                    array(
                        ':wid' => $website->id,
                        ':lang' => $current['lang'],
                        ':time' => core_time(),
                        ':categories' => implode(",", $categories)
                    ));
             WHERE website = '.intval($website->id).'
			 WHERE i.category IN(:categories)
			   AND i.website = :wid
			   AND (i.date_published = 0 OR i.date_published < :time)
			   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
			   AND (s.date_published = 0 OR s.date_published < :time)
			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
			   AND d.lang = :lang
		$DB->query(
		    $query,
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang'],
                ':time' => core_time(),
                ':categories' => implode(",", $categories)
            )
        );
    // now we have all elements that will be shown in the list (if any)
    if(empty($rs))
    {
        $rs = array();
    }

                        ' category = '.intval($item->id).' AND
                          website = '.intval($item->website).' AND
                    ');
		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.intval($item->user));
                            {
                                $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
                            }
								 WHERE category = '.intval($current['category']).'
								   AND website = '.intval($website->id).'
            $last = $DB->query_single('parent', 'nv_structure', ' id = '.intval($last));
		$DB->query(
		    'SELECT node_id, text
                  FROM nv_webdictionary 
                 WHERE node_type = "structure"
                   AND subtype = "title" 
                   AND lang = :lang
                   AND website = :wid',
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang']
            )
        );
		$DB->query(
		    'SELECT object_id, path
                  FROM nv_paths 
                 WHERE type = "structure"
                   AND lang = :lang
                   AND website = :wid',
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang']
            )
        );
			   AND lang = :lang
			   AND website = :wid',
            'object',
            array(
                ':wid' => $website->id,
                ':lang' => $current['lang']
            )
		$DB->query(
		    'SELECT * 
                  FROM nv_structure
                 WHERE parent = '.intval($parent).' 
                   AND website = '.intval($website->id).' 
                  ORDER BY position ASC'
        );
                ' node_type = :type AND
				    node_id = :object_id AND
					subtype = "title" AND
					website = :wid AND
					   lang = :lang',
                null,
                array(
                    ':wid' => $website->id,
                    ':lang' => $current['lang'],
                    ':object_id' => $current['object']->id,
                    ':type' => $current['type']
                )
				 WHERE website = '.intval($website->id).'
				   AND object_id = '.intval($object_id).'
			   AND d.lang = :lang
        '.$limit,
        'object',
        array(
            ':lang' => $current['lang']
        )
					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.intval($vars['id']));
                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.intval($vars['id']));
				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.intval($vars['id']));
			    $file = $DB->query_single('name', 'nv_files', ' id = '.intval($property->value).' AND website = '.intval($website->id));
                                                    p.website = '.intval($website->id).' AND
			                                p.website = '.intval($website->id).' AND
                   AND wd.website = ' . intval($website->id) . '			  
                   AND d.website = ' . intval($website->id) . '
    $query_params = array(
        ':wid' => $website->id,
        ':lang' => $lang,
        ':types' => implode(',', $types)
    );

    {
        $extra .= ' AND text LIKE :search'; // note: we will need to pass another filter after exploding the tags
        $query_params[':search'] = '%' . $search . '%';
    }
          WHERE website = :wid
            AND node_type IN(:types)
            AND lang = :lang 
        'array',
        $query_params
                    ' website = :wid
					  AND webuser = :webuser_id
					  AND object = :type
					  AND object_id = :object_id',
                    null,
                    array(
                        ':wid' => $website->id,
                        ':webuser_id' => $webuser->id,
                        ':type' => $current['type'],
                        ':object_id' => $current['id']
                    )
                        ' email = :email
                          AND website = :wid',
                        null,
                        array(
                            ':wid' => $website->id,
                            ':email' => $email
                        )
                  website = :wid
                        email = :email OR
                        username = :username
                    )',
                    'object',
                    array(
                        ':wid' => $website->id,
                        ':email' => $email,
                        ':username' => mb_strtolower($username)
                    )
                        ' email = :email
                          AND website = :wid',
                        null,
                        array(
                            ':wid' => $website->id,
                            ':email' => $email
                        )
            ' LOWER(username) = :username AND website = :wid',
            null,
            array(
                ':wid' => $website->id,
                ':username' => $username
            )
            ' LOWER(username) = :email AND website = :wid',
            null,
            array(
                ':wid' => $website->id,
                ':email' => $email
            )
    $nuid = $DB->query_single(
        'id',
        'nv_users',
        'cookie_hash = :cookie_hash',
        NULL,
        array(':cookie_hash' => $_COOKIE['navigate-user'])
    );
// is it a recover password request?
        ' username = :value OR email = :value',
        NULL,
        array(':value' => $value)
            'activation_key = :activation_key',
            NULL,
            array(':activation_key' => $value)
                     WHERE website = '.intval($website->id).'
		 WHERE subdomain = :subdomain
		   AND ( domain = :domain OR domain = :idn_domain ) 
	 ',
        'object',
        array(
            ':subdomain' => $subdomain,
            ':domain' => $domain,
            ':idn_domain' => $idn->encode($domain)
        ));
							 WHERE id = '.intval($current['id']).'
								   WHERE id = '.intval($current['id']).' 
							 WHERE id = '.intval($current['id']).'
								   WHERE id = '.intval($current['id']).' 
				WHERE path = :route AND 
				ORDER BY id DESC',
                'object',
                array(':route' => '/' . $route)
                                            WHERE id = '.intval($current['id']).' 
                                     WHERE id = '.intval($current['id']).'
                                           WHERE id = '.intval($current['id']).' 
                                     WHERE id = '.intval($current['id']).'
                                           WHERE id = '.intval($current['id']).' 
                'website = :website_id
                 AND template = :template_type
                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
                NULL,
                array(
                    ':website_id' => $website->id,
                    ':template_type' => $template_type
                )
                'website = :website_id
                 AND template = :template_type
                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
                NULL,
                array(
                   ':website_id' => $website->id,
                   ':template_type' => $template_type
                )
		' type = :type
		   AND object_id = :object_id
		   AND lang = :lang
		   AND website = '.$website->id,
        NULL,
        array(
            ':type' => $type,
            ':object_id' => $id,
            ':lang' => $lang
        )
				   AND lang = :lang
				   AND theme = :ws_theme 
				   AND lang = :lang
				   AND website = '.$website->id,
        'object',
        array(
            ':lang' => $session['lang'],
            ':ws_theme' => $website->theme,
        )
    );
								   AND lang = :lang
								   AND website = '.$website->id,
                                NULL,
                                array(
                                    ':lang' => $current['lang']
                                )
				 WHERE website = '.intval($website_id).'
					           AND w.text LIKE :category_name
					   )',
                    'object',
                    array(':category_name' => $category_name)
                );