  def move_in_team_folder
    Log.add_info(request, params.inspect)

    return unless request.post?

    @item = Item.find(params[:id])

    team_folder = @item.team.get_team_folder

    @item.update_attribute(:folder_id, team_folder.id)

    flash[:notice] = t('msg.move_success')

    render(:partial => 'ajax_move_in_team_folder', :layout => false)

  rescue => evar
    Log.add_error(request, evar)
    render(:partial => 'ajax_move_in_team_folder', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.