  def add_to_group
    Log.add_info(request, params.inspect)

    return unless request.post?

    if params[:thetisBoxSelKeeper].blank?
      render(:partial => 'ajax_groups', :layout => false)
      return
    end

    group_id = params[:thetisBoxSelKeeper].split(':').last
    unless group_id == '0'  # '0' for ROOT
      begin
        group = Group.find(group_id)
      rescue => evar
        Log.add_error(request, evar)
      ensure
        if group.nil?
          render(:partial => 'ajax_groups', :layout => false)
          return
        end
      end
    end

    begin
      @user = User.find(params[:user_id])
    rescue => evar
      Log.add_error(request, evar)
    end

    unless @user.nil?

      is_modified = false

      # Change, not simply Add
      unless params[:current_id].blank?
        if @user.exclude_from(params[:current_id])
          is_modified = true
        end
      end

      is_modified = true if @user.add_to(group_id)

      if is_modified == true
        @user.save!

        if @user.id == @login_user.id
          @login_user = @user
        end
      end
    end

    render(:partial => 'ajax_groups', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.