  def do_send
    Log.add_info(request, params.inspect)

    return unless request.post?

    begin
      email = Email.find(params[:id])

      if email.status != Email::STATUS_DRAFT
        # Ignore clicked Send button twice or more at once.
        raise('ERROR:' + 'Specified E-mail is not a draft.')
      end

      mail_account = MailAccount.find(email.mail_account_id)
      if mail_account.user_id != @login_user.id
        raise('ERROR:' + t('msg.need_to_be_owner'))
      end

      sent_folder = MailFolder.get_for(@login_user, mail_account.id, MailFolder::XTYPE_SENT)
      email.do_smtp(mail_account)

      attrs = ActionController::Parameters.new({status: Email::STATUS_TRANSMITTED, mail_folder_id: sent_folder.id, sent_at: Time.now})
      email.update_attributes(attrs.permit(Email::PERMIT_BASE))

      flash[:notice] = t('msg.transmit_success')
    rescue => evar
      Log.add_error(request, evar)
      flash[:notice] = 'ERROR:' + t('msg.transmit_failed') + '<br/>' + evar.to_s
    end

    render(:partial => 'common/flash_notice', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.