  def ajax_delete_mails
    Log.add_info(request, params.inspect)

    folder_id = params[:id]
    mail_account_id = params[:mail_account_id]

    unless params[:check_mail].blank?
      mail_folder = MailFolder.find(folder_id)
      trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)

      count = 0
      params[:check_mail].each do |email_id, value|
        next if value != '1'

        begin
          email = Email.find(email_id)
        rescue => evar
        end
        next if email.nil? or (email.user_id != @login_user.id)

        if trash_folder.nil? \
            or folder_id == trash_folder.id.to_s \
            or mail_folder.get_parents(false).include?(trash_folder.id.to_s)
          email.destroy
          flash[:notice] ||= t('msg.delete_success')
        else
          begin
            email.update_attribute(:mail_folder_id, trash_folder.id)
            flash[:notice] ||= t('msg.moved_to_trash')
          rescue => evar
            Log.add_error(request, evar)
            email.destroy
            flash[:notice] ||= t('msg.delete_success')
          end
        end

        count += 1
      end
    end

    get_mails
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.