  def paginate_by_sql(model, sql, per_page, options={})
    if options[:count].blank?
      total = model.count_by_sql_wrapping_select_query(sql)
    else
      if options[:count].is_a?(Integer)
        total = options[:count]
      #else
      #  total = model.count_by_sql(options[:count])
      end
    end

    SqlHelper.validate_token([params['page']])
    object_pages = model.paginate_by_sql(sql, {:page => params['page'], :per_page => per_page})
    return [object_pages, object_pages, total]
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.