  def self.get_tree(klass, tree, conditions, node_id, order_by)

    SqlHelper.validate_token([node_id])
    if conditions.nil?
      con = ''
    else
      con = Marshal.load(Marshal.dump(conditions)) + ' and '
    end
    con << "(parent_id=#{node_id})"

    tree[node_id] = klass.where(con).order(order_by).to_a

    tree[node_id].each do |node|
      tree = klass.get_tree(tree, conditions, node.id.to_s)
    end

    return tree
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.