// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: csharp
// expected: SQL injection via string concatenation in WHERE IN clause

using System.Data.SqlClient;

namespace App.Data
{
    public class BatchOrderService
    {
        private readonly string _conn;

        public BatchOrderService(string conn) => _conn = conn;

        public SqlDataReader GetOrdersByIds(string rawIds)
        {
            // Vulnerable: rawIds like "1,2,3" injected into IN clause
            string sql = $"SELECT * FROM Orders WHERE Id IN ({rawIds})";
            var connection = new SqlConnection(_conn);
            connection.Open();
            return new SqlCommand(sql, connection).ExecuteReader();
        }
    }
}