  def self.get_default_for(user_id, xtype=nil)

    SqlHelper.validate_token([user_id, xtype])

    con = []
    con << "(user_id=#{user_id.to_i})"
    con << '(is_default=1)'
    con << "(xtype='#{xtype}')" unless xtype.blank?

    where = ''
    unless con.nil? or con.empty?
      where = 'where ' + con.join(' and ')
    end

    mail_accounts = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')

    if mail_accounts.nil? or mail_accounts.empty?
      return nil
    else
      return mail_accounts.first
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.