  def update_order
    Log.add_info(request, params.inspect)

    mail_account_id = params[:mail_account_id]
    order_arr = params[:mail_filters_order]

    SqlHelper.validate_token([mail_account_id])

    @mail_account = MailAccount.find(mail_account_id)

    if @mail_account.user_id != @login_user.id
      render(:text => 'ERROR:' + t('msg.need_to_be_owner'))
      return
    end

    filters = MailFilter.get_for(mail_account_id)
    # filters must be ordered by xorder ASC.

    filters.sort! { |filter_a, filter_b|
      id_a = filter_a.id.to_s
      id_b = filter_b.id.to_s

      idx_a = order_arr.index(id_a)
      idx_b = order_arr.index(id_b)

      if idx_a.nil? or idx_b.nil?
        idx_a = filters.index(id_a)
        idx_b = filters.index(id_b)
      end

      idx_a - idx_b
    }

    idx = 1
    filters.each do |filter|
      next if filter.mail_account_id != mail_account_id.to_i

      filter.update_attribute(:xorder, idx)

      idx += 1
    end

    render(:text => '')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.