  def query
    Log.add_info(request, '')   # Not to show passwords.

    unless @login_user.admin?(User::AUTH_ZEPTAIR)
      render(:text => 'ERROR:' + t('msg.need_to_be_admin'))
      return
    end

    target_user = nil

    SqlHelper.validate_token([params[:user_id], params[:zeptair_id], params[:group_id]])

    unless params[:user_id].blank?
      target_user = User.find(params[:user_id])
    end

    unless params[:zeptair_id].blank?
      zeptair_id = params[:zeptair_id]
      target_user = User.where("zeptair_id=#{zeptair_id}").first
    end

    if target_user.nil?

      if params[:group_id].blank?
        sql = 'select distinct Item.* from items Item, attachments Attachment'
        sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
        sql << ' order by Item.user_id ASC'
      else
        group_ids = [params[:group_id]]

        if params[:recursive] == 'true'
          group_ids += Group.get_childs(params[:group_id], true, false)
        end

        groups_con = []
        group_ids.each do |group_id|
          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{@group_id}|")
        end
        sql = 'select distinct Item.* from items Item, attachments Attachment, users User'
        sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
        sql << " and (Item.user_id=User.id and (#{groups_con.join(' or ')}))"
        sql << ' order by Item.user_id ASC'
      end

      @post_items = Item.find_by_sql(sql)
    else
      @post_item = ZeptairPostHelper.get_item_for(target_user)
    end

  rescue => evar
    Log.add_error(request, evar)
    render(:text => 'ERROR:' + t('msg.system_error'))
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.