  def self.find_term(user_id, start_date, end_date)

    SqlHelper.validate_token([user_id])

    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)

    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
    ary = Timecard.where(con).order('date ASC').to_a
    timecards_h = Hash.new
    unless ary.nil?
      ary.each do |timecard|
        timecards_h[timecard.date.strftime(Schedule::SYS_DATE_FORM)] = timecard
      end
    end
    return timecards_h
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.