  def self.up
    add_column :items, :source_id, :integer

    add_column :addresses, :groups, :text
    add_column :addresses, :teams, :text

    add_column :workflows, :groups, :text

    add_column :users,  :figure, :string
    add_column :groups, :xtype, :string

    add_column :teams, :req_to_del_at, :datetime
    change_table :teams do |t|
      t.timestamps
    end

    teams = Team.all
    unless teams.nil?
      teams.each do |team|
        begin
          item = Item.find(team.item_id)
        rescue
        end
        next if item.nil?

        attrs = ActionController::Parameters.new({created_at: item.created_at, updated_at: item.updated_at})
        attrs.permit!
        team.update_attributes(attrs)
      end
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.