This looks like a SQL injection vulnerability. What if a user put malicious content into one of the columns of xt.obj_type?