  def update_titles_order
    Log.add_info(request, params.inspect)

    return unless request.post?

    titles = params[:titles_order]

    org_order = User.get_config_titles
    org_order = [] if org_order.nil?

    User.save_config_titles(titles)

    idx = 0
    titles.each do |title|
      if title != org_order[idx]
        User.update_xorder(title, idx)
      end
      idx += 1
    end
    render(:text => '')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.