// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: csharp
// expected: SQL injection via string concatenation in SqlCommand

using System.Data.SqlClient;

namespace App.Data
{
    public class UserRepository
    {
        private readonly string _connectionString;

        public UserRepository(string connectionString) => _connectionString = connectionString;

        public SqlDataReader FindByUsername(string username)
        {
            var conn = new SqlConnection(_connectionString);
            conn.Open();
            // Vulnerable: direct string concatenation into SQL
            var cmd = new SqlCommand(
                "SELECT * FROM Users WHERE Username = '" + username + "'", conn);
            return cmd.ExecuteReader();
        }
    }
}