  def update_groups_order
    Log.add_info(request, params.inspect)

    return unless request.post?

    order_ary = params[:groups_order]

    Research.set_statistics_groups(order_ary)

    render(:text => '')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.