// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection via string concatenation in executeQuery

import java.sql.*;

public class UserRepository {
    private Connection conn;

    public ResultSet findByUsername(String username) throws SQLException {
        // Vulnerable: direct string concatenation into SQL
        String query = "SELECT * FROM users WHERE username = '" + username + "'";
        Statement stmt = conn.createStatement();
        return stmt.executeQuery(query);
    }

    public boolean deleteUser(String userId) throws SQLException {
        String sql = "DELETE FROM users WHERE id = " + userId;
        Statement stmt = conn.createStatement();
        return stmt.executeUpdate(sql) > 0;
    }
}