    function update() {
        global $db, $user;
        	
        $this->params['id'] = $db->selectValue('content_expRatings','expratings_id',"content_id='".$this->params['content_id']."' AND content_type='".$this->params['content_type']."' AND subtype='".$this->params['subtype']."' AND poster='".$user->id."'");
        $msg = gt('Thank you for your rating');
        $rating = new expRating($this->params);
        if (!empty($rating->id)) $msg = gt('Your rating has been adjusted');
        // save the rating
        $rating->update($this->params);

        // attach the rating to the datatype it belongs to (blog, news, etc..);
        $obj = new stdClass();
		$obj->content_type = $this->params['content_type'];
		$obj->content_id = $this->params['content_id'];
		$obj->expratings_id = $rating->id;
		$obj->poster = $rating->poster;
		if(isset($this->params['subtype'])) $obj->subtype = $this->params['subtype'];
		$db->insertObject($obj, $rating->attachable_table);

        $ar = new expAjaxReply(200,$msg);
        $ar->send();
		
        // flash('message', $msg);
        // expHistory::back();
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.