Language: PHP
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
   public function getPriceByReferenceAndSupplier($plugin_order_references_id, $suppliers_id) {
      global $DB;

      $table = self::getTable();
      $query = "SELECT `price_taxfree`
                FROM `$table`
                WHERE `plugin_order_references_id` = '$plugin_order_references_id'
                AND `suppliers_id` = '$suppliers_id' ";
      $result = $DB->query($query);

      if ($DB->numrows($result) > 0) {
         return $DB->result($result, 0, "price_taxfree");
      } else {
         return 0;
      }
   }