        def self.search_by_user(key, operator, value)
          key_name = key.sub(/^.*\./,'')
          users = User.all(:conditions => "#{key_name} #{operator} '#{value_to_sql(operator, value)}'")
          hosts = users.map(&:hosts).flatten
          opts  = hosts.empty? ? "= 'nil'" : "IN (#{hosts.map(&:id).join(',')})"

          return {:conditions => " hosts.id #{opts} " }
        end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.