Placeholders will not be replaced in index, if translation not found...

If $index not found in database, it will be returned without replacing
the placeholders...
Additional:
Placeholders shouldn't be "null" - this indicates it could be a mixed
value - it's just an array and we can use php to validiate it.
Fix: Possible injection through "language".

Maybe a Cookie-Manipulation or HTTP-ACCEPT-LANGUAGE can welcome some
sql-injectors here.
Fix.