  def save_page
    Log.add_info(request, params.inspect)

    # Next page
    pave_val = params[:page].to_i + 1
    @page = sprintf('%02d', pave_val)

    page_num = Dir.glob(File.join(Research.page_dir, "_q[0-9][0-9].html.erb")).length

    unless params[:research].nil?
      params[:research].each do |key, value|
        if value.instance_of?(Array)
          value.compact!
          value.delete('')
          if value.empty?
            params[:research][key] = nil
          else
            params[:research][key] = value.join("\n") + "\n"
          end
        end
      end
    end

    research_id = params[:research_id]
    SqlHelper.validate_token([research_id])
    if research_id.blank?
      @research = Research.new(params.require(:research).permit(Research::PERMIT_BASE))
      @research.status = Research::U_STATUS_IN_ACTON
      @research.update_attribute(:user_id, @login_user.id)
    else
      @research = Research.find(research_id)
      @research.update_attributes(params.require(:research).permit(Research::PERMIT_BASE))
    end

    if pave_val <= page_num

      render(:action => 'edit_page')

    else

      tmpl_folder, tmpl_q_folder = TemplatesHelper.get_tmpl_subfolder(TemplatesHelper::TMPL_RESEARCH)

      if tmpl_q_folder.nil?
        ary = TemplatesHelper.setup_tmpl_folder
        tmpl_q_folder = ary[4]
      end

      items = Folder.get_items_admin(tmpl_q_folder.id, 'xorder ASC')

      @q_caps_h = {}
      unless items.nil?
        items.each do |item|

          desc = item.description
          next if desc.nil? or desc.empty?

          hash = Research.select_q_caps(desc)
          hash.each do |key, val|
            @q_caps_h[key] = val
          end
        end
      end

      render(:action => 'confirm')
    end

  rescue => evar
    Log.add_error(request, evar)
    @page = '01'
    render(:action => 'edit_page')
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.