	public WorkflowSearcher(Map<String, Object> map, User user) {

		schemeId = getStringValue("schemeId", map);
		assignedTo = getStringValue("assignedTo", map);
		createdBy = getStringValue("createdBy", map);
		stepId = getStringValue("stepId", map);
		keywords = getStringValue("keywords", map);
		orderBy = getStringValue("orderBy", map);
		
		
		orderBy= SQLUtil.sanitizeSortBy(orderBy);
		show4all = getBooleanValue("show4all", map);
		open = getBooleanValue("open", map);
		closed = getBooleanValue("closed", map);
		String daysOldstr = getStringValue("daysold", map);
		
		if(UtilMethods.isSet(daysOldstr) && daysOldstr.matches("^\\d+$"))
		    daysOld = Integer.parseInt(daysOldstr);

		this.user = user;

		try {
			page = Integer.parseInt((String) getStringValue("page", map));
		} catch (Exception e) {
			page = 0;
		}
		if (page < 0)
			page = 0;
		try {
			count = Integer.parseInt((String) getStringValue("count", map));
		} catch (Exception e) {
			count = 20;
		}
		if (count < 0)
			count = 20;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.