  def self.get_tree_by_group_for_admin(group_id)

    SqlHelper.validate_token([group_id])

    folder_tree = {}
    tree_id = '0'

    if group_id.to_s == '0'
      sql = 'select distinct * from folders'

      where = " where (parent_id = #{tree_id})"
      where << " and ((xtype is null) or not(xtype = '#{XTYPE_GROUP}' or xtype = '#{XTYPE_USER}'))"

      order_by = ' order by xorder ASC, id ASC'
    else
      sql = 'select distinct Folder.* from folders Folder, users User'

      where = " where (Folder.parent_id = #{tree_id})"
      where << ' and ('
      where <<      "(Folder.xtype = '#{XTYPE_GROUP}' and Folder.owner_id = #{group_id})"
      where <<      ' or '
      where <<      "(Folder.xtype = '#{XTYPE_USER}' and  Folder.owner_id = User.id and #{SqlHelper.get_sql_like(['User.groups'], "|#{group_id}|")})"
      where <<     ' )'

      order_by = ' order by Folder.xorder ASC, Folder.id ASC'
    end

    sql << where + order_by

    folder_tree[tree_id] = Folder.find_by_sql(sql)

    folder_tree[tree_id].each do |folder|
      folder_tree = Folder.get_tree(folder_tree, nil, folder, true)
    end

    return Folder.sort_tree(folder_tree)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.