  def self.get_tmpl_subfolder(name)

    SqlHelper.validate_token([name])

    tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first

    unless tmpl_folder.nil?
      con = "(parent_id=#{tmpl_folder.id}) and (name='#{name}')"
      begin
        child = Folder.where(con).first
      rescue => evar
        Log.add_error(nil, evar)
      end
    end

    return [tmpl_folder, child]
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.