  def update_q_ctrl
    Log.add_info(request, params.inspect)

    return unless request.post?

    item_id = params[:item_id]
    q_code = params[:q_code]
    q_param = params[:q_param]
    cap = params[:caption]

    yaml = Research.get_config_yaml

    type = q_param.split(':').first
    vals = q_param[type.length+1 .. -1]

    yaml[q_code] = {:item_id => item_id, :type => type, :values => vals, :caption => cap.to_s }

    Research.save_config_yaml(yaml)

    render(:text => '')

  rescue => evar
    Log.add_error(request, evar)
    render(:text => evar.to_s)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.