        def self.search_by_params(key, operator, value)
          key_name = key.sub(/^.*\./,'')
          condition = sanitize_sql_for_conditions(["name = ? and value #{operator} ?", key_name, value_to_sql(operator, value)])
          opts     = {:conditions => condition, :order => :priority}
          p        = Parameter.all(opts)
          return {:conditions => '1 = 0'} if p.blank?

          max         = p.first.priority
          condition   = sanitize_sql_for_conditions(["name = ? and NOT(value #{operator} ?) and priority > ?",key_name,value_to_sql(operator, value), max])
          negate_opts = {:conditions => condition, :order => :priority}
          n           = Parameter.all(negate_opts)

          conditions = param_conditions(p)
          negate = param_conditions(n)

          conditions += " AND " unless conditions.blank? || negate.blank?
          conditions += " NOT(#{negate})" unless negate.blank?
          return {:conditions => conditions}
        end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.