  def new
    if params[:action] == 'new'
      Log.add_info(request, params.inspect)
    end

    return unless request.post?

    render(:action => 'edit', :layout => (!request.xhr?))
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.