  def destroy
    Log.add_info(request, params.inspect)

    return unless request.post?

    mail_account_id = params[:mail_account_id]
    SqlHelper.validate_token([mail_account_id])

    mail_folder = MailFolder.find(params[:id])
    trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)

    if trash_folder.nil?
      mail_folder.force_destroy
      render(:text => '')
    else
      if mail_folder.get_parents(false).include?(trash_folder.id.to_s)
        mail_folder.force_destroy
        render(:text => '')
      else
        mail_folder.update_attribute(:parent_id, trash_folder.id)
        flash[:notice] = t('msg.moved_to_trash')

        prms = ApplicationHelper.get_fwd_params(params)
        prms[:controller] = params[:controller]
        prms[:action] = 'show_tree'
        @redirect_url = ApplicationHelper.url_for(prms)
        render(:partial => 'common/redirect_to', :layout => false)
      end
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.