  def create
    Log.add_info(request, params.inspect)

    return unless request.post?

    parent_id = params[:selectedFolderId]

    unless Folder.check_user_auth(parent_id, @login_user, 'w', true)
      flash[:notice] = 'ERROR:' + t('folder.need_auth_to_modify')
      render(:partial => 'ajax_folder_entry', :layout => false)
      return
    end

    if params[:thetisBoxEdit].blank?
      @folder = nil
    else
      @folder = Folder.new
      @folder.name = params[:thetisBoxEdit]
      @folder.xorder = Folder.get_order_max(parent_id) + 1
      @folder.parent_id = parent_id
      @folder.inherit_parent_auth
      @folder.save!
    end
    render(:partial => 'ajax_folder_entry', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.