  def update
    Log.add_info(request, '')   # Not to show passwords.

    return unless request.post?

    @user = User.find(params[:id])

    attrs = _process_user_attrs(@user, params[:user])
    attrs.delete(:password)

    # Official title and order to display
    title = attrs[:title]
    unless title.nil?
      attrs[:xorder] = User::XORDER_MAX

      titles = User.get_config_titles
      if !titles.nil? and titles.include?(title)
        attrs[:xorder] = titles.index(title)
      end
    end

    if @user.update_attributes(attrs.except(:id).permit(User::PERMIT_BASE))

      flash[:notice] = t('msg.update_success')

      if @user.id == @login_user.id
        @login_user = @user
      end
      if params[:from] == 'users_list'
        redirect_to(:controller => 'users', :action => 'list')
      else
        redirect_to(:controller => 'desktop', :action => 'show')
      end
    else
      render(:controller => 'users', :action => 'edit')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.