  def update_break
    Log.add_info(request, params.inspect)

    return unless request.post?

    unless params[:user_id].nil?
      @selected_user = User.find(params[:user_id])

      if @selected_user.id != @login_user.id and !@login_user.admin?(User::AUTH_TIMECARD)
        Log.add_check(request, '[User::AUTH_TIMECARD]'+request.to_s)
        redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
        return
      end
    end

    @timecard = Timecard.find(params[:id])

    @date = Date.parse params[:date]
    start_dt = UtilDateTime.new(@date.year, @date.month, @date.day, params[:start_hour].to_i, params[:start_min].to_i)
    end_dt = UtilDateTime.new(@date.year, @date.month, @date.day, params[:end_hour].to_i, params[:end_min].to_i)

    if start_dt == end_dt
      flash[:notice] = 'ERROR:' + t('timecard.break_without_span')
      render(:partial => 'ajax_update_break', :layout => false)
      return
    end

    org_start_t = start_dt.to_time
    org_end_t = end_dt.to_time

    if org_end_t < org_start_t
      end_dt += 1
    else
      if (@timecard.end.nil? or @timecard.start.day != @timecard.end.day) and org_end_t <= @timecard.start
        start_dt += 1
        end_dt += 1
      end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.