  def show_tree
    if params[:action] == 'show_tree'
      Log.add_info(request, params.inspect)
    end

    con = []
    con << "(user_id=#{@login_user.id})"

    account_xtype = params[:mail_account_xtype]

    unless account_xtype.blank?
      SqlHelper.validate_token([account_xtype])
      con << "(xtype='#{account_xtype}')"
    end
    @mail_accounts = MailAccount.find_all(con.join(' and '))

    mail_account_ids = []
    @mail_accounts.each do |mail_account|

      mail_account_ids << mail_account.id

      if MailFolder.where("mail_account_id=#{mail_account.id}").count <= 0
        @login_user.create_default_mail_folders(mail_account.id)
      end

      Email.destroy_by_user(@login_user.id, "status='#{Email::STATUS_TEMPORARY}'")
    end

    @folder_tree = MailFolder.get_tree_for(@login_user, mail_account_ids)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.