  def set_workflow
    Log.add_info(request, params.inspect)

    @item = Item.find(params[:id])

    orders_hash = params.dup
    orders_hash.reject! { |key, value|
      key.index(/order-/) != 0
    }
    orders_hash.sort_by { |key, value|
      key.split('-').last.to_i
    }

    orders = []
    orders_hash.each do |key, value|

      orders << '|' + value.split(',').join('|') + '|'
    end
    @item.workflow.update_attribute(:users, orders.join(','))

    render(:partial => 'ajax_item_workflow', :layout => false)

  rescue => evar
    Log.add_error(request, evar)

    render(:partial => 'ajax_item_workflow', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.