  def activity_user
    user = current_user.pref[:activity_user]
    if user && user != "all_users"
      user = if user =~ /@/ # email
          User.where(:email => user).first
        else # first_name middle_name last_name any_name
          name_query = if user.include?(" ")
            user.name_permutations.map{ |first, last|
              User.where(:first_name => first, :last_name => last)
            }.map(&:to_a).flatten.first
          else
            [User.where(:first_name => user), User.where(:last_name => user)].map(&:to_a).flatten.first
          end
        end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.