  def empty
    Log.add_info(request, params.inspect)

    return unless request.post?

    @folder_id = params[:id]
    mail_account_id = params[:mail_account_id]
    SqlHelper.validate_token([@folder_id, mail_account_id])

    trash_folder = MailFolder.get_for(@login_user, mail_account_id, MailFolder::XTYPE_TRASH)

    mail_folder = MailFolder.find(@folder_id)
    emails = (MailFolder.get_mails(mail_folder.id, @login_user) || [])

    if mail_folder.id == trash_folder.id \
        or mail_folder.get_parents(false).include?(trash_folder.id.to_s)
      emails.each do |email|
        email.destroy
      end
      flash[:notice] = t('msg.delete_success')
    else
      emails.each do |email|
        email.update_attribute(:mail_folder_id, trash_folder.id)
      end
      flash[:notice] = t('msg.moved_to_trash')
    end

    get_mails
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.