  def create_label
    Log.add_info(request, params.inspect)

    return unless request.post?

    if params[:thetisBoxEdit].empty?
      render(:partial => 'ajax_label', :layout => false)
      return
    end

    @toy = Toy.new

    @toy.xtype = Toy::XTYPE_LABEL
    @toy.message = params[:thetisBoxEdit]
    if @login_user.nil?
      t = Time.now
      @toy.id = (t.hour.to_s + t.min.to_s + t.sec.to_s).to_i
      @toy.x, @toy.y = DesktopsHelper.find_empty_block(@login_user)
    else
      @toy.user_id = @login_user.id
      @toy.x, @toy.y = DesktopsHelper.find_empty_block(@login_user)
      @toy.save!
    end

    render(:partial => 'ajax_label', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.