  def add_holidays
    Log.add_info(request, params.inspect)

    return unless request.post?

    holidays = params[:thetisBoxEdit]
    unless holidays.nil?
      holidays.split("\n").each do |holiday|
        tokens = holiday.split(',')
        date = DateTime.parse(tokens.shift.strip)
        date += date.offset   # 2011-01-01 09:00:00 +0900 (==> 2011-01-01 00:00:00 UTC)
        name = tokens.join(',').strip

        schedule = Schedule.new
        schedule.xtype = Schedule::XTYPE_HOLIDAY
        schedule.scope = Schedule::SCOPE_ALL
        schedule.title = name
        schedule.start = date
        schedule.end = date
        schedule.allday = true
        schedule.save!
      end
    end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.