  def save
    Log.add_info(request, params.inspect)

    return unless request.post?

    unless params[:attach_file].nil?
      attach_attrs = { :file => params[:attach_file] }
      params.delete(:attach_file)
    end

    @mail_account = MailAccount.find(params[:mail_account_id])
    if @mail_account.user_id != @login_user.id
      flash[:notice] = 'ERROR:' + t('msg.need_to_be_owner')
      render(:partial => 'common/flash_notice', :layout => false)
      return
    end

    @email = SendMailsHelper.get_mail_to_send(@login_user, @mail_account, params)

    begin
      @email.save!

      unless attach_attrs.nil?
        attach_attrs[:email_id] = @email.id
        attach_attrs[:xorder] = 0
        @email.mail_attachments << MailAttachment.create(attach_attrs)
        @email.save!  # To recalcurate size
      end

      if THETIS_MAIL_LIMIT_NUM_PER_ACCOUNT > 0
        Email.trim(@login_user.id, @mail_account.id, THETIS_MAIL_LIMIT_NUM_PER_ACCOUNT)
      end
      if THETIS_MAIL_CAPACITY_MB_PER_ACCOUNT > 0
        Email.trim_by_capacity(@login_user.id, @mail_account.id, @mail_account.get_capacity_mb)
      end
      # flash[:notice] = t('msg.save_success')
    rescue => evar
      logger.fatal(evar.to_s)
      if evar.to_s.starts_with?('ERROR:')
        flash[:notice] = evar.to_s
      else
        flash[:notice] = 'ERROR:' + t('msg.system_error') + '<br/>' + evar.to_s
      end
    end

    render(:partial => 'ajax_mail_content', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.