  def self.get_childs(folder_id, conditions, recursive, admin, ret_obj)

    SqlHelper.validate_token([folder_id])
    arr = []

    if recursive

      folder_tree = Folder.get_tree(Hash.new, conditions, folder_id, admin)
      return [] if folder_tree.nil?

      folder_tree.each do |parent_id, childs|
        if ret_obj
          arr |= childs
        else
          childs.each do |folder|
            folder_id = folder.id.to_s
            arr << folder_id unless arr.include?(folder_id)
          end
        end
      end

    else

      con = Marshal.load(Marshal.dump(conditions))
      if con.nil?
        con = ''
      else
        con << ' and '
      end
      con << "parent_id=#{folder_id}"

      unless admin
        con << " and (xtype is null or not (xtype='#{Folder::XTYPE_SYSTEM}'))"
      end

      folders = Folder.where(con).order('xorder ASC').to_a
      if ret_obj
        arr = folders
      else
        folders.each do |folder|
          arr << folder.id.to_s
        end
      end
    end

    return arr
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.