  def update_groups_order
    Log.add_info(request, params.inspect)

    return unless request.post?

    order_ary = params[:groups_order]

    groups = Group.get_childs(params[:id], false, false)
    # groups must be ordered by xorder ASC.

    groups.sort! { |id_a, id_b|

      idx_a = order_ary.index(id_a)
      idx_b = order_ary.index(id_b)

      if idx_a.nil? or idx_b.nil?
        idx_a = groups.index(id_a)
        idx_b = groups.index(id_b)
      end

      idx_a - idx_b
    }

    idx = 1
    groups.each do |group_id|
      begin
        group = Group.find(group_id)
        group.update_attribute(:xorder, idx)
        idx += 1
      rescue => evar
        group = nil
        Log.add_error(request, evar)
      end
    end

    render(:text => '')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.