  def create
    Log.add_info(request, '')   # Not to show passwords.

    return unless request.post?

    if params[:mail_account][:smtp_auth].nil? or params[:mail_account][:smtp_auth] != '1'
      params[:mail_account].delete(:smtp_username)
      params[:mail_account].delete(:smtp_password)
    end

    @mail_account = MailAccount.new(params.require(:mail_account).permit(MailAccount::PERMIT_BASE))
    @mail_account.user_id = @login_user.id

    @mail_account.is_default = true

    begin
      @mail_account.save!
    rescue
      if request.xhr?
        render(:partial => 'mail_account_error', :layout => false)
      else
        redirect_to(:controller => 'mail_folders', :action => 'show_tree')
      end
      return
    end

    flash[:notice] = t('msg.register_success')

    if request.xhr?
      render(:partial => 'common/flash_notice', :layout => false)
    else
      redirect_to(:controller => 'mail_folders', :action => 'show_tree')
    end
  end
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.