  def post_label
    Log.add_info(request, params.inspect)

    return unless request.post?

    if params[:txaPostLabel].empty? or params[:post_to].empty?
      render(:text => '')
      return
    end

    params[:post_to].each do |user_id|
      user = User.find(user_id)
      toy = Toy.new

      toy.xtype = Toy::XTYPE_POSTLABEL
      toy.message = params[:txaPostLabel]
      toy.user_id = user.id
      toy.posted_by = @login_user.id
      toy.x, toy.y = DesktopsHelper.find_empty_block(user)
      toy.save!
    end

    flash[:notice] = t('msg.post_success')
    render(:partial => 'common/flash_notice', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.