  def new
    Log.add_info(request, params.inspect)

    mail_account_id = params[:mail_account_id]

    if mail_account_id.blank?
      account_xtype = params[:mail_account_xtype]
      SqlHelper.validate_token([account_xtype])
      @mail_account = MailAccount.get_default_for(@login_user.id, account_xtype)
    else
      @mail_account = MailAccount.find(mail_account_id)
      if @mail_account.user_id != @login_user.id
        flash[:notice] = 'ERROR:' + t('msg.need_to_be_owner')
        render(:partial => 'common/flash_notice', :layout => false)
        return
      end
    end

    if $thetis_config[:menu]['disp_user_list'] == '1'
      unless params[:to_user_ids].blank?
        @email = Email.new
        to_addrs = []
        @user_obj_cache ||= {}
        params[:to_user_ids].each do |user_id|
          user = User.find_with_cache(user_id, @user_obj_cache)
          user_emails = user.get_emails_by_type(nil)
          user_emails.each do |user_email|
            disp = EmailsHelper.format_address_exp(user.get_name, user_email, false)
            entry_val = "#{disp}"   # "#{disp}#{Email::ADDR_ORDER_SEPARATOR}#{user.get_xorder(@group_id)}"

            to_addrs << entry_val
          end
        end
        @email.to_addresses = to_addrs.join(Email::ADDRESS_SEPARATOR)
      end
    end

    render(:action => 'edit', :layout => (!request.xhr?))
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.