  def users
    Log.add_info(request, params.inspect)

    @item = Item.find(params[:item_id])

    con = []

    unless params[:keyword].blank?
      key_array = params[:keyword].split(nil)
      key_array.each do |key| 
        con << SqlHelper.get_sql_like([:name, :email, :fullname, :address, :organization], key)
      end
    end

    @group_id = nil
    if !params[:thetisBoxSelKeeper].nil?
      @group_id = params[:thetisBoxSelKeeper].split(':').last
    elsif !params[:group_id].blank?
      @group_id = params[:group_id]
    end
    SqlHelper.validate_token([@group_id])

    unless @group_id.nil?
      con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
    end

    include_comment = false

    filter_status = params[:filter_status]
    SqlHelper.validate_token([filter_status])

    unless filter_status.blank?
      case filter_status
        when ZeptairDistHelper::STATUS_REPLIED
          con << "((Comment.item_id=#{@item.id}) and (Comment.xtype='#{Comment::XTYPE_DIST_ACK}') and (Comment.user_id=User.id))"
          include_comment = true
        when ZeptairDistHelper::STATUS_COMPLETE
          ack_msg = ZeptairDistHelper.completed_ack_message(@item.id)
          con << "((Comment.item_id=#{@item.id}) and (Comment.xtype='#{Comment::XTYPE_DIST_ACK}') and (Comment.user_id=User.id) and (Comment.message='#{ack_msg}'))"
          include_comment = true
        when ZeptairDistHelper::STATUS_NO_REPLY
          comments = Comment.where("((Comment.item_id=#{@item.id}) and (Comment.xtype='#{Comment::XTYPE_DIST_ACK}'))").to_a
          except_users = []
          unless comments.nil?
            comments.each do |comment|
              except_users << comment.user_id
            end
          end
          unless except_users.empty?
            con << '(User.id not in (' + except_users.join(',') + '))'
          end
        else
          ;
      end
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.