    it "should collapse all comments and emails on Contact" do
      where_stub = double
      where_stub.should_receive(:update_all).with(:state => "Collapsed")
      Comment.should_receive(:where).and_return(where_stub)
      xhr :get, :timeline, :id => "1,2,3,4+", :state => "Collapsed"
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.