  def login
    Log.add_info(request, '')   # Not to show passwords.

    user = User.authenticate(params[:user])

    if user.nil?

      flash[:notice] = '<span class=\'font_msg_bold\'>'+t('user.u_name')+'</span>'+t('msg.or')+'<span class=\'font_msg_bold\'>'+t('password.name')+'</span>'+t('msg.is_invalid')

      if params[:fwd_controller].nil? or params[:fwd_controller].empty?

        redirect_to(:controller => 'login', :action => 'index')
      else

        url_h = {:controller => 'login', :action => 'index', :fwd_controller => params[:fwd_controller], :fwd_action => params[:fwd_action]}

        unless params[:fwd_params].nil?
          params[:fwd_params].each do |key, val|
            url_h["fwd_params[#{key}]"] = val
          end
        end

        redirect_to(url_h)
      end

    else

      @login_user = LoginHelper.on_login(user, session)

      if params[:fwd_controller].nil? or params[:fwd_controller].empty?
        prms = ApplicationHelper.get_fwd_params(params)
        prms.delete('user')
        prms[:controller] = 'desktop'
        prms[:action] = 'show'
        redirect_to(prms)
      else
        url_h = {:controller => params[:fwd_controller], :action => params[:fwd_action]}
        url_h = url_h.update(params[:fwd_params]) unless params[:fwd_params].nil?
        redirect_to(url_h)
      end
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.