  def paidhld_update_multi
    Log.add_info(request, params.inspect)

    return unless request.post?

    year = params[:year].to_i
    num = params[:num].to_f

    group_id = params[:group_id]
    users_hash = (params[:check_user] || {})
    SqlHelper.validate_token([group_id, users_hash.keys])

    done = false
    users_hash.each do |user_id, value|
      if value == '1'
        PaidHoliday.update_for(user_id, year, num)
        done = true
      end
    end

    unless done
      if group_id.blank?
        users = (User.find_all || [])
      else
        users = Group.get_users(group_id)
      end

      users.each do |user|
        PaidHoliday.update_for(user.id, year, num)
      end
    end
    flash[:notice] = t('msg.update_success')

    self.users
    render(:action => 'users')

  rescue => evar
    Log.add_error(request, evar)
    flash[:notice] = 'ERROR:' + evar.to_s

    self.users
    render(:action => 'users')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.