  def new

    @item = Item.new
    if params[:folder_id].blank?
      my_folder = @login_user.get_my_folder
      if my_folder.nil?
        @item.folder_id = 0
      else
        @item.folder_id = my_folder.id
      end
    else
      @item.folder_id = params[:folder_id].to_i
    end
    @item.xtype= Item::XTYPE_INFO
    @item.layout = 'C'

    render(:action => 'edit')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.