  def get_folders_order
    Log.add_info(request, params.inspect)

    @folder_id = params[:id]
    SqlHelper.validate_token([@folder_id])

    if @folder_id == '0'
      @folders = MailFolder.get_account_roots_for(@login_user)
    else
      mail_folder = MailFolder.find(@folder_id)
      if mail_folder.user_id == @login_user.id
        @folders = MailFolder.get_childs(@folder_id, false, true)
      end
    end

    render(:partial => 'ajax_folders_order', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.