  def get_folder_items
    Log.add_info(request, params.inspect)

    unless params[:thetisBoxSelKeeper].nil? or params[:thetisBoxSelKeeper].empty?
      @folder_id = params[:thetisBoxSelKeeper].split(':').last
    end

    begin
      if Folder.check_user_auth(@folder_id, @login_user, 'r', true)
        @items = Folder.get_items(@login_user, @folder_id)
      end
    rescue => evar
      Log.add_error(request, evar)
    end

    submit_url = url_for(:controller => 'schedules', :action => 'get_folder_items')
    render(:partial => 'common/select_items', :layout => false, :locals => {:target_attr => :id, :submit_url => submit_url})
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.