  def show_summary
    Log.add_info(request, params.inspect)

    mail_account_id = params[:id]
    SqlHelper.validate_token([mail_account_id])

    begin
      @mail_account = MailAccount.find(mail_account_id)
    rescue => evar
      Log.add_error(request, evar)
      redirect_to(:controller => 'login', :action => 'logout')
      return
    end

    @folder_tree = MailFolder.get_tree_for(@login_user, [mail_account_id])
# logger.fatal('@@@ ' + sorted_mail_folders.flatten.collect{|rec| rec.name}.inspect)
    mail_folders = TreeElement.get_flattened_nodes(@folder_tree)
    mail_folder_ids = mail_folders.collect{|rec| rec.id.to_s}

    @unread_emails_h = {}
    unless mail_folder_ids.nil? or mail_folder_ids.empty?
      unread_emails = Email.where("user_id=#{@login_user.id} and status='#{Email::STATUS_UNREAD}' and mail_folder_id in (#{mail_folder_ids.join(',')})").to_a
      unread_emails.each do |email|
        mail_folder = mail_folders.find{|rec| rec.id == email.mail_folder_id}
        unless mail_folder.nil?
          @unread_emails_h[mail_folder] ||= 0
          @unread_emails_h[mail_folder] += 1
        end
      end
    end
    @unread_emails_h = @unread_emails_h.sort_by{|mail_folder, count| mail_folders.index(mail_folder) }

    @draft_emails_h = {}
    unless mail_folder_ids.nil? or mail_folder_ids.empty?
      draft_emails = Email.where("user_id=#{@login_user.id} and status='#{Email::STATUS_DRAFT}' and mail_folder_id in (#{mail_folder_ids.join(',')})").to_a
      draft_emails.each do |email|
        mail_folder = mail_folders.find{|rec| rec.id == email.mail_folder_id}
        unless mail_folder.nil?
          @draft_emails_h[mail_folder] ||= 0
          @draft_emails_h[mail_folder] += 1
        end
      end
    end
    @draft_emails_h = @draft_emails_h.sort_by{|mail_folder, count| mail_folders.index(mail_folder) }

    @folder_obj_cache ||= MailFolder.build_cache(mail_folders)

    render(:layout => (!request.xhr?))
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.