  def paginate_by_sql(model, sql, per_page, options={})
    if options[:count]
      if options[:count].is_a?(Integer)
        total = options[:count]
      else
        total = model.count_by_sql(options[:count])
      end
    else
      total = model.count_by_sql_wrapping_select_query(sql)
    end

    object_pages = model.paginate_by_sql(sql, {:page => params['page'], :per_page => per_page})
    #objects = model.find_by_sql_with_limit(sql, object_pages.current.to_sql[1], per_page)
    return [object_pages, object_pages, total]
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.