  def update
    Log.add_info(request, params.inspect)

    return unless request.post?

    @address = Address.find(params[:id])
    @address.attributes = params[:address]

    @address = AddressbookHelper.arrange_per_scope(@address, @login_user, params[:scope], params[:groups], params[:teams])
    if @address.nil?
      flash[:notice] = t('msg.need_to_be_owner')
      redirect_to(:controller => 'desktop', :action => 'show')
      return
    end

    if @address.save
      flash[:notice] = t('msg.update_success')
      if request.xhr?
        render(:partial => 'common/flash_notice', :layout => false)
      else
        list
        render(:action => 'list')
      end
    else
      render(:controller => 'addressbook', :action => 'edit', :layout => (!request.xhr?))
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.