  def group
    Log.add_info(request, params.inspect)

    date_s = params[:date]
    if date_s.blank?
      @date = Date.today
    else
      @date = Date.parse(date_s)
    end

    @group_id = params[:id]
    SqlHelper.validate_token([@group_id, params[:id]])
    group_users = Group.get_users(params[:id])

    @user_schedule_hash = {}
    unless group_users.nil?
      @holidays = Schedule.get_holidays
      group_users.each do |user|
        @user_schedule_hash[user.id.to_s] = Schedule.get_somebody_week(@login_user, user.id, @date, @holidays)
      end
    end

    params[:display] = params[:action] + '_' + params[:id]
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.