  def self.update_xorder(title, order)

    if title.nil?
      con = nil
    else
      con = ['title=?', title]
    end

    SqlHelper.validate_token([order])
    User.update_all("xorder=#{order}", con)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.