  def update_comment
    Log.add_info(request, params.inspect)

    return unless request.post?

    unless params[:thetisBoxEdit].empty?
      @comment = Comment.find(params[:comment_id])
      if @comment.nil?
        redirect_to(THETIS_RELATIVE_URL_ROOT + '/404.html' )
        return
      end
      @comment.message = params[:thetisBoxEdit]
      @comment.save

      @item = Item.find(@comment.item_id)
    end
    render(:partial => 'ajax_comment', :layout => false)
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.