  def add_comment
    Log.add_info(request, params.inspect)

    return unless request.post?

    unless params[:comment][:file].nil?
      attach_params = { :file => params[:comment][:file] }
      params[:comment].delete(:file)
    end

    @comment = Comment.new(params.require(:comment).permit(Comment::PERMIT_BASE))
    @comment.save!
    @item = @comment.item

    unless attach_params.nil? or attach_params[:file].size <= 0
      @comment.attachments << Attachment.create(attach_params, @comment, 0)
    end

    # Sends Mail to the owner of the item.
    # user = User.find(@item.user_id)
    # NoticeMailer.comment(user, ApplicationHelper.root_url(request)).deliver unless user.nil?

    case @item.xtype
      when Item::XTYPE_WORKFLOW
        @workflow = @item.workflow
        if @workflow.update_status and @workflow.decided?
          @workflow.distribute_cc
        end
        @orders = @workflow.get_orders

        render(:partial => 'ajax_workflow', :layout => false)

      when Item::XTYPE_PROJECT
        if @comment.xtype == Comment::XTYPE_APPLY

          flash[:notice] = t('msg.done_success')
          render(:partial => 'ajax_team_cancel', :layout => false)
        else
          render(:partial => 'ajax_comments', :layout => false)
        end

      else
        render(:partial => 'ajax_comments', :layout => false)
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.