  def delete_break
    Log.add_info(request, params.inspect)

    return unless request.post?

    @timecard = Timecard.find(params[:id])

    if params[:org_start].nil?
      org_start = nil
    else
      org_start = UtilDateTime.parse(params[:org_start]).to_time
    end

    @timecard.delete_break(org_start)

    unless params[:user_id].nil?
      @selected_user = User.find(params[:user_id])

      if @selected_user.id != @login_user.id and !@login_user.admin?(User::AUTH_TIMECARD)
        Log.add_check(request, '[User::AUTH_TIMECARD]'+request.to_s)
        redirect_to(:controller => 'frames', :action => 'http_error', :id => '401')
        return
      end
    end

    render(:partial => 'ajax_update_break', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.