def get_info_for_package(pkg, channel_id, org_id):
    log_debug(3, pkg)
    pkg = map(str, pkg)
    params = {'name': pkg[0],
              'ver': pkg[1],
              'rel': pkg[2],
              'epoch': pkg[3],
              'arch': pkg[4],
              'channel_id': channel_id,
              'org_id': org_id}
    # yum repo has epoch="0" not only when epoch is "0" but also if it's NULL
    if pkg[3] == '0' or pkg[3] == '' or pkg[3]==None:
        epochStatement = "(epoch is null or epoch = :epoch)"
    else:
        epochStatement = "epoch = :epoch"
    if params['org_id']:
        orgStatement = "org_id = :org_id"
    else:
        orgStatement = "org_id is null"

    statement = """
    select p.path, cp.channel_id,
           cv.checksum_type, cv.checksum
      from rhnPackage p
      join rhnPackageName pn
        on p.name_id = pn.id
      join rhnPackageEVR pe
        on p.evr_id = pe.id
      join rhnPackageArch pa
        on p.package_arch_id = pa.id
      left join rhnChannelPackage cp
        on p.id = cp.package_id
       and cp.channel_id = :channel_id
      join rhnChecksumView cv
        on p.checksum_id = cv.id
     where pn.name = :name
       and pe.version = :ver
       and pe.release = :rel
       and %s
       and pa.label = :arch
       and %s
     order by cp.channel_id nulls last
    """ % (epochStatement, orgStatement)

    h = rhnSQL.prepare(statement)
    h.execute(**params)

    ret = h.fetchone_dict()
    if not ret:
        return {'path':          None,
                'channel_id': None,
                'checksum_type': None,
                'checksum':      None,
                }
    return ret
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.