  def self.get_for(group_id, include_parents=false, enabled=nil)

    SqlHelper.validate_token([group_id])

    con = []
    #con << "(disabled=#{!enabled})" unless enabled.nil?

    if include_parents
      group_con = '(group_id is null)'

      unless group_id.nil? or group_id.to_s == '0'
        group_obj_cache = {}
        group = Group.find_with_cache(group_id, group_obj_cache)
        group_ids = group.get_parents(false, group_obj_cache)
        group_ids << group_id
        group_con << " or (group_id in (#{group_ids.join(',')}))"
      end

      con << '(' + group_con + ')'
    else
      con << "(group_id=#{group_id})"
    end

    order_by = 'order by xorder ASC, id ASC'
    #order_by = 'order by disabled ASC, xorder ASC, id ASC'

    sql = 'select * from official_titles where ' + con.join(' and ') + ' ' + order_by

    return OfficialTitle.find_by_sql(sql)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.