  def create
    Log.add_info(request, params.inspect)

    return unless request.post?

    attrs = _process_user_attrs(nil, params[:user])
    password = attrs[:password]
    attrs.delete(:password)

    @user = UsersHelper.get_initialized_user(attrs.permit(User::PERMIT_BASE))
    @user.auth = User::AUTH_ALL if User.count <= 0

    begin
      @user.save!
    rescue
      render(:controller => 'users', :action => 'new')
      return
    end

    @user.setup

    flash[:notice] = t('msg.register_success')

    if params[:from] == 'users_list'
      redirect_to(:controller => 'users', :action => 'list')
    else
      NoticeMailer.welcome(@user, password, ApplicationHelper.root_url(request)).deliver
      flash[:notice] << '<br/><span class=\'font_msg_bold\' style=\'color:firebrick;\'>'+t('user.initial_password')+'</span>'+t('msg.sent_by')+'<span class=\'font_msg_bold\'>'+t('email.name')+'</span>'+t('msg.check_it')
      redirect_to(:controller => 'login', :action => 'index')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.